Backing up your business data: two copies and a test

Ask a shop owner where last year's sales are and the answer is often a laptop, a spreadsheet on a phone or a box of receipt rolls. Ask what happens if that laptop is stolen tonight and the answer is silence. Backing up is the cheapest insurance a business can buy, and the guidance for doing it well fits on one page.

What to back up

The UK National Cyber Security Centre's guide for small organisations says to "make a copy (also known as a backup) of all the data that your business needs to operate", and lists examples: "your website, emails, invoicing, documents, presentations, contacts and customer information". For an East African counter business, write your own list. It will usually include:

• Sales and stock records, or the login to the system that holds them.
• The accounting ledger, bank and mobile money statements.
• Supplier invoices and EFRIS or KRA filings.
• Staff records and payroll.
• Licences, the trading licence, tenancy and insurance documents.
• Photos of the shop, stock and fittings for an insurance claim.

If an item on the list exists only on one phone or one laptop, it is not backed up.

Why one copy is not enough

The NCSC lists the ways data is lost: a ransomware attack "may lock your data so you can't access it", the device may be "lost, stolen or damaged", and hardware simply fails. The common thread is that the copy and the original are in the same place at the same time. Its tip is to "consider using online and a storage device to create two backups", so that one survives whatever took the other.

Cloud plus a disconnected drive

Cloud storage is the first copy. The NCSC says "you can back up your data to the internet (also known as the cloud) if you have reliable internet access", that most providers offer some free storage, and that the account must be protected by "turning on 2-step verification (2SV)". A business whose point of sale and accounting already run in the cloud has this copy by default: the records live on the provider's servers, not on the till. Your job is to protect the login.

The second copy is a USB drive or external disk. Here the NCSC rule is strict: "the device should not stay connected to your device when not in use", because some malware spreads to attached drives. A monthly export to a drive that then goes in the office safe is a backup; a drive that lives plugged into the till is just more storage.

The test most owners skip

A backup you have never restored is a hope. The NCSC puts it plainly: "it's important you know how to restore it, and to check that it contains all your important data". Once a quarter, open the drive on a different computer and check that the files open. For cloud systems, sign in from a new device and confirm you can see last month's reports. Note who holds the password and where the drive is kept, because the person who set this up is not always the person who needs it.

Accounts are part of the backup

Backups protect data; they do not protect the login that reaches the data. The NCSC's advice on important accounts is that each needs "a strong password that you don't use for any other account", that turning on 2-step verification "is one of the most effective ways to protect online accounts", and that you should "remove or disable the accounts you no longer use". For a business that means the owner holds the master account, staff have their own logins, and a departing cashier loses access on their last day.

A backup routine for a small business

When	What
Daily	The till syncs to the cloud; check that nothing is pending
Weekly	Export or photograph paper documents received that week
Monthly	Copy exports and documents to the external drive, then disconnect it
Quarterly	Restore test on a different machine; review who has access
On any staff change	Remove the leaver's logins the same day

The whole routine takes less than an hour a month. The alternative is explaining to URA, a bank or an insurer that the records were on the laptop that went.

Sources

1. https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data
2. https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-important-online-accounts