A cloud backup can report “successful” every night and still leave a small business exposed. Perhaps the finance software is covered but its exports are not. Perhaps an employee’s laptop holds the only copy of a key spreadsheet. Or perhaps nobody has tried restoring the files since the system was installed.
This business cloud backup checklist is designed to find those gaps before an outage, accidental deletion or cyberattack. Work through each area, record what you can prove, and give every unresolved item an owner and a deadline.
Build a simple backup audit record
Start with a shared document or spreadsheet containing six fields: system or data set, backup location, frequency, retention period, responsible person and last successful restore test. Add a seventh field for actions needed. Use “verified”, “needs checking” or “gap found” rather than assuming a service is protected because it uses the cloud.
Review the record whenever you add software, change suppliers or alter how staff store files.
Check what is actually protected
Identify your critical information
☐ List accounting records, invoices, customer files, email, calendars, project documents, website data and any industry-specific records needed to operate.
☐ Record where each item is stored, including individual laptops, shared drives, mobile devices and third-party applications.
☐ Check whether the backup includes databases, application settings and other information needed to rebuild a working service, not just individual documents.
Cloud storage and cloud backup are not necessarily the same thing. Synchronisation can carry an accidental deletion or unwanted change across devices. Verify whether your service preserves earlier versions or independent recovery copies, and for how long.
Match backup frequency to the cost of losing data
☐ For each system, decide how much recent work the business could afford to lose. This is your recovery point objective: for example, four hours of invoicing changes rather than an entire week.
☐ Confirm that the actual backup schedule meets that target and that failed jobs generate alerts someone reads.
☐ Note whether backups continue when laptops are offline, staff are travelling or a cloud application changes its configuration.
A weekly backup may be adequate for rarely updated reference material, but poor protection for orders arriving throughout the day.
Review retention and backup separation
☐ Confirm how many historical versions or recovery points remain available and when older copies are deleted.
☐ Check for at least one suitably separated copy that an attacker using ordinary staff credentials cannot easily alter or erase. Offline or appropriately immutable backups can strengthen protection against ransomware.
☐ Document how long records must be retained for operational, contractual or legal reasons, and when they should be securely deleted.
The familiar 3-2-1 approach means keeping three copies of important data, across two devices or media, with one copy off-site. It is a useful starting point, not proof that every copy is secure or restorable. Retention also needs its own decision: keeping everything forever can create unnecessary cost and data-protection risk.
Audit access, encryption and supplier controls
☐ Identify who can view, restore, change or delete backups. Limit privileged access to those who genuinely need it.
☐ Enable multi-factor authentication on backup administration accounts and check whether backup credentials are separate from routine user accounts.
☐ Confirm that appropriate encryption protects backup data in transit and at rest, and that encryption keys will still be available during an emergency.
☐ Ask where backup data is held, which suppliers process it and what security and recovery commitments appear in your contract.
For UK businesses handling personal information, the UK GDPR requires appropriate security measures, including an ability to restore access to personal data in a timely manner following an incident. It does not prescribe one universal backup frequency or retention period. A practical cloud backup security guide can help staff understand the access controls behind the checklist.
Prove that business data recovery works
☐ Restore a sample of current files and an older version into a safe test location. Open them and confirm they are complete and usable.
☐ Test a critical application or database recovery where possible, including any configuration needed to make it work again.
☐ Record the time taken, missing permissions, failed steps and whether the recovery met the business’s acceptable downtime.
☐ Keep recovery instructions somewhere accessible if your primary systems or usual administrator account are unavailable.
Imagine a six-person design agency that stores client artwork in shared cloud folders. Its audit shows daily backup jobs, but a test reveals that a deleted project folder cannot be recovered beyond 30 days. An archived client requests revisions after six weeks. The agency now has a clear decision: extend suitable retention, preserve completed projects separately or adjust its client handover process.
Schedule restore exercises after significant system changes and at sensible intervals based on risk.
Assign owners and turn gaps into actions
☐ Name one person who checks failures, one who can authorise a restore and a deputy for absences.
☐ Record supplier support contacts, escalation procedures and what happens if a provider or internet connection is unavailable.
☐ Rank issues by impact: missing backups for a payment database deserve attention before minor discrepancies in old marketing files.
For each gap, write an action, owner and due date. Keep a brief record of completed fixes and subsequent tests. This transforms the cloud backup plan into an auditable routine. It also gives you the foundation for a wider business disaster recovery plan covering people, communications and temporary workarounds.
Frequently asked questions
How often should a small business check its cloud backups?
Review backup failure alerts routinely, inspect coverage after system changes and conduct periodic restore tests. The appropriate testing interval depends on how quickly data changes and how damaging an interruption would be.
Is OneDrive or Google Drive enough on its own?
Not automatically. Cloud storage can provide version history and recovery features, but their scope and retention limits vary. Check the service settings and consider a separate backup if important records need stronger protection.
Does a small business need three backup copies?
Three copies are a widely used resilience principle, not a universal legal rule. Multiple independently protected copies reduce the chance that one failure, account compromise or ransomware incident destroys every recovery option.
Who should own the backup checklist?
A named employee or external IT provider should maintain the technical record, while a business decision-maker approves acceptable data loss, downtime and spending. Both roles need a documented deputy.
Make the checklist a repeatable habit
Start with your most business-critical system, trace its data to a recovery copy and complete one real restore. Then work through the remaining systems. A useful backup checklist for business is not the longest one; it is the one that reveals what is missing, names who will fix it and gives you evidence that recovery will work when it matters.
