Backups
Business backups
Plan small business backups around essential records, recovery needs, protected copies, clear ownership and restore checks.
A business backup plan should answer four questions: what must be recoverable, how much recent work the business could afford to lose, where protected copies are kept, and who can restore them. A successful backup notification is useful, but the plan also needs a tested route to usable information.
The Australian Cyber Security Centre (ACSC) publishes guidance on backing up files and devices and on cloud shared responsibility for individuals and small and medium businesses. Use its cloud guidance to confirm which protection and restore tasks remain with your business.
Start with the work that must resume
List the records and systems behind essential tasks, such as taking bookings, completing jobs and issuing invoices. Include email, calendars, shared files and information held in specialist applications. Check whether important records remain only on individual devices.
Examples include MYOB Accountants Office, Xero and Microsoft 365 in accounting IT, plus large project files and cloud storage for design and construction work. Treat these as prompts to check your own coverage, not as proof that each system has a separate backup.
One named Backup as a Service example is SysCloud Backup. Its AWS Marketplace listing says it supports Google Workspace, Microsoft 365, Slack, QuickBooks Online, HubSpot, Salesforce, Xero and Box; check the precise coverage and recovery options for any plan you consider.
For each task, name someone who can describe a usable recovery. A folder of files may be enough for one task; another may need application data, software and settings together.
Ask each application supplier what the business can export or restore. Cloud backup coverage and recovery options depend on the service and its configuration. Confirm the exact inclusions with the supplier and record any limits.
Developing a Business Backup Plan: Key Steps
- Define recovery needs per taskSet RPO (acceptable data gap) and RTO (acceptable interruption) based on business impact.
- Choose backup frequency and storage methodUse daily snapshots for high-risk systems; consider offline or immutable cloud copies for protection against ransomware.
- Assign ownership and test restoresName a recovery owner for each task; conduct regular restore tests at a separate location to verify usability.
- Review and update regularlyReassess when staff, software, or infrastructure changes—especially after migrating to new platforms.
Set recovery needs for each task
Ask how much recent work staff could recreate if the latest information were lost, and how long the task could remain unavailable. Use those answers to choose backup frequency and a recovery route.
The acceptable data gap is often called the recovery point objective (RPO), while the acceptable interruption is the recovery time objective (RTO). Set both for each task rather than assuming one target suits the whole business.
Frequent backups will not meet a short recovery target if the restore itself takes too long or authorised staff cannot start it. Test access and elapsed restore time against the task's target.
| Record for each task | Decision to make |
|---|---|
| Required information | Which files, application data and settings are needed together? |
| Acceptable data gap | How much recent work could be recreated? |
| Acceptable interruption | When must staff be able to use the task again? |
| Recovery owner | Who can authorise and carry out the restore? |
| Proof | What will a worker do to confirm the result is usable? |
These are business targets to check through a restore exercise. They are not promises made by a backup product.
Published examples illustrate different cadences: ProBackup describes daily snapshots of Pipedrive accounts, while BlueStone Tech lists image-level endpoint backups tested monthly in its Standard plan. These are examples, not universal targets; choose frequency against the acceptable RPO and test restores against the RTO.
Protect copies against different failures
A connected backup device can help with routine recovery, but malware or unauthorised access may also reach it. Consider an offline copy or another protected way to retrieve an earlier, unaffected version.
Keep a copy away from the original location where a fire or theft could affect both. Secure physical media and consider encryption for sensitive records. Protect cloud backup accounts with multi-factor authentication where available, and check who can change or delete copies.
BlueStone Tech lists Microsoft 365 backup as immutable and stored in Sydney AU in its Standard plan. SysCloud's listing describes backups in isolated repositories within a secure cloud environment; verify the actual storage location, retention and account access for any service.
Local and cloud backup approaches each have trade-offs. See the dedicated comparison guide before choosing.
Local vs Cloud Backup: Trade-offs for Australian Businesses
- Control & AccessHigh control over physical media; direct access to local backups. Cloud backups offer remote access but depend on internet and service availability.
- Security & CompliancePhysical media can be secured with encryption and offsite storage. Cloud providers like Metwide and BlueStone Tech store data in Sydney (AU), compliant with Australian data residency rules.
- Resilience Against ThreatsLocal backups may be vulnerable to fire, theft or malware if connected. Cloud backups with immutable storage (e.g., BlueStone Tech) resist deletion and ransomware.
Pros and Cons of Cloud Backup for Australian SMEs
- ProsAutomated backups, scalable pricing, built-in redundancy, supports remote work, and meets ATO record-keeping requirements when configured correctly.
- ConsDependence on internet connectivity, potential for misconfigured permissions, risk of account compromise without MFA, and variable retention periods not always aligned with legal obligations.
Assign ownership and check recovery
Record what each backup includes, where its copies are stored, how long versions remain available and who receives failure alerts. Keep restore instructions and necessary access available to authorised people if the usual device or account is unavailable. Review coverage when applications, storage locations, staff or equipment change.
Schedule a restore to a separate location and ask the task owner to open and use the recovered information. Record the selected backup, result, time taken and any gaps.
A file check establishes only that the selected file and route worked during that test. Critical applications may also need a broader exercise covering related data, software and settings.
SysCloud's AWS Marketplace listing describes a 30-day backup health indicator and 90-day history of restores and exports. Those figures are monitoring and history windows, not a stated retention period for backup versions, so record retention separately.
BlueStone Tech lists its Standard plan at $119 per user per month, GST inclusive, for 10–50 staff, including Microsoft 365 backup and endpoint backup. Treat this as one listed offer rather than a market rate, and check current terms before budgeting.
Essential Backup Plan Checklist for Australian Businesses
- Store backups securely and offsiteUse encrypted physical media or cloud services with immutable storage located in Australia.
- Assign a recovery owner for each taskEnsure someone can authorise and execute a restore during an incident.
- Test restores quarterlyVerify that recovered data is usable by restoring to a separate environment and confirming functionality.
In this guide
- Identifying the files and systems that must be recoverableTrace essential work to the files, application data and settings needed for recovery, then record ownership, location and a usable restore check.
- Comparing local and cloud backup approachesCompare local and cloud backups by restore needs, site risk, version protection, administration and the terms of the actual service.
- Testing whether a business backup can actually restore filesRun a safe file restore, check the recovered version with its owner, record the result and understand what a file test cannot prove.
