A backup is not what you have copied. It is what you can restore. Many companies discover the difference on the worst day: the accounting file is corrupted, the laptop with the customer list is stolen, or a ransomware message appears on the office screen. This guide shows a small UAE business how to build backups that work, and how to test them without a specialist.
Start with what you cannot afford to lose
List the data in order of damage if lost:
- Financial records: accounting data, invoices, bank files, VAT and tax records.
- Customer and sales data: contacts, quotations, contracts and order history.
- Operational systems: your ERP, CRM, website and databases.
- Staff and legal documents: licences, visas, contracts and insurance.
- Working files: designs, drawings, spreadsheets and reports.
Two numbers decide how you back up. Recovery point: how much recent work can you afford to lose (one day, one hour)? Recovery time: how long can the business stop (one hour, one day)? Write both down for each system.
The 3-2-1 rule, explained simply
- 3 copies of important data: the working copy and two backups.
- 2 different kinds of storage, for example a cloud service and an external drive.
- 1 copy kept away from the office, so a fire, flood or theft cannot take everything.
Add one more rule for ransomware: keep at least one copy that cannot be changed or deleted from the office network, such as a cloud backup with versioning or a drive that is disconnected after the backup runs.
What to do for each type of system
| System | Backup method | Frequency |
|---|---|---|
| Website and database | Hosting provider snapshots plus your own export copied elsewhere | Daily |
| ERP, CRM or accounting (hosted) | Vendor backups, plus a periodic export you control | Daily vendor, monthly export |
| ERP or custom system on your own server | Database dump and uploaded files copied to cloud storage | Daily, kept for 30 days |
| Staff laptops and shared files | Cloud drive sync with version history | Continuous |
| Provider retention plus archive for key mailboxes | Continuous |
Test the restore, not only the backup
- Every quarter, pick one system and restore it to a test location.
- Check that the data opens and that yesterday's work is there.
- Time it. If the restore takes six hours and your recovery time is two, you have found a gap while it is cheap to fix.
- Record the result and who did it.
Protect against the common causes
- Ransomware and phishing: train staff, keep software updated and limit admin rights. See cyber security basics.
- Hardware failure and theft: encrypt laptops and keep nothing important only on one device.
- Human error: version history lets you roll back a file someone overwrote.
- Power and connectivity: a small UPS for key equipment and a mobile data fallback.
- Supplier failure: hold your own exports from any service you rely on. See where your data lives.
A one-page recovery plan
Write a single page that anyone in management can follow:
- Who decides that an incident has happened, and who is the backup if they are away.
- The list of systems in order of restoration, with the person responsible for each.
- Where backups live and who holds the access credentials, kept in a secure place.
- Contact details for your hosting provider, software vendor and IT support.
- Who tells customers, and what the first message says.
Review it twice a year. If you run your own systems, our support contract guide shows what to ask a vendor to cover, and our hosting guide lists what to check in a provider.