Small Business Backup Checklist: Test a Safe Restore

Practical Guide · Research-based guidance checked 2 November 2026 against official security and product documentation. The worked project example is fictional. This is a small-business planning workflow, not a claim that we tested a particular backup product or recovered a real client’s data.

A backup feels reassuring right up until the moment you need to open it. A folder may appear to be syncing. An external drive may have been connected last month. A website plugin may say its scheduled job completed. None of those signs answers the question that matters: can you recover the files needed to keep working?

This small business backup checklist is for freelancers and one-person businesses that rely on documents, client deliverables, invoices, websites and cloud accounts. It starts with what would hurt to lose, then shows how to run a safe restore test without experimenting on your live work. You do not need an enterprise recovery platform to learn whether your current arrangement has obvious gaps.

Start your small business backup checklist with the work you cannot replace

Do not begin by shopping for storage. Begin with a short inventory of the information that would be expensive, slow or impossible to recreate. For a small service business, the most important files are not always the largest. A signed scope document, current client handoff, or invoice register may matter more than a folder of old screenshots.

Write down where each item lives, who owns the account, how often it changes and how you would recover it if the device or account disappeared. The UK’s National Cyber Security Centre’s guidance for small organisations explicitly includes websites, emails, invoicing, documents and customer information among data worth protecting.

Business information	Where it usually lives	What to verify
Current client deliverables	Local folders and shared drives	Recover a previous version and the latest approved version
Contracts and approvals	Email, e-sign tools, client folders	Export or restore readable copies with dates
Invoices and bookkeeping	Accounting software, spreadsheets	Export a usable report and check access
Website content and configuration	Hosting account and WordPress	Know whether both files and database are covered
Passwords and recovery information	Password manager and account recovery settings	Know how to regain access without relying on one lost device

This is an inventory, not an invitation to duplicate sensitive client material everywhere. Check contractual storage and retention rules before making extra copies. If a client owns the workspace, clarify which records you may keep after handoff. The client offboarding checklist covers the related question of what should be delivered, retained or removed when work ends.

Know the difference between sync, version history and a backup

These three functions can all help, but they are not interchangeable. Sync keeps working copies aligned across devices. That is convenient when a laptop fails, but an accidental deletion or unwanted edit may also be reflected across synced locations. Version history and trash may help reverse certain changes, subject to the provider’s rules and retention window. An independent backup is a separately recoverable copy with a retention and access plan you understand.

For example, Microsoft’s OneDrive restoration documentation describes a Microsoft 365 subscriber feature for undoing file and folder actions within the previous 30 days. It also warns that permanently deleted recycle-bin items cannot be recovered through that feature. That is useful recovery functionality, but it is not a reason to assume every old file or account loss can be reversed.

Similarly, Google documents a standard 30-day Drive trash deletion policy, with separate administrative and retention provisions in some environments. Do not build your business recovery plan around an unlimited trash folder.

A practical rule: if deleting or corrupting the primary copy could also remove your only other copy, you have not demonstrated independent recovery. You may still use sync for daily convenience; just understand which layer protects against which failure.

Choose two recovery paths before buying another tool

For a lean setup, think in terms of separate failure paths rather than a long product list. One option is automated cloud backup plus a periodically updated encrypted external drive stored disconnected when not in use. Another is a provider’s managed backup with independent retention, plus a second protected copy. The exact arrangement depends on client restrictions, device type, budget and how much data changes each day.

Ask four questions before choosing:

Independence: Could one accidental deletion, compromised account or stolen laptop affect both copies?
History: Can you recover a version from before an unnoticed error?
Security: Are backups encrypted and access-controlled? Can a stolen drive expose client data?
Recovery: Can you retrieve and open a file without the original device or a single unavailable person?

The NCSC recommends keeping backups and checking that they restore correctly; it also suggests considering both online storage and a separate storage device for additional protection. See its backup and restore guidance. A disconnected or otherwise protected copy can reduce the chance that the same incident damages every copy, although no one arrangement is risk-free.

Do not assume an external drive is safe because it is physical. Drives fail, get misplaced and can be left attached during an incident. Do not assume a cloud subscription automatically covers your website database, mailbox, domain settings or third-party apps either. Check the actual service agreement and restore instructions.

Run a small business backup checklist restore test in 20 minutes

The purpose of a first test is modest: prove that at least one representative file can be recovered from the backup copy and opened correctly. It does not certify that your whole business could be restored after a major incident. The NCSC’s response and recovery guide recommends testing backups regularly rather than trusting that a backup job exists.

Pick a harmless test file. Create a document named backup-restore-test-2026-11.txt with a non-sensitive sentence and the date. Do not use confidential client information for a demonstration.
Put it in a covered location. Save it in the folder or system your current backup claims to protect. Note the original location and the expected backup destination.
Wait for the documented backup process. Check its status, completion time and any error messages. A successful status is a clue, not the final result.
Restore to a different folder. Use the provider’s documented recovery workflow to restore the file into a new, clearly labeled test folder. Never overwrite your only live copy to perform this check.
Open and compare. Read the restored document. Check its contents, file type and expected date. If you need version recovery, make a second harmless edit and test whether the earlier version is retrievable.
Record the outcome. Note the backup source, steps used, time needed, result and any missing permissions. Delete the disposable test copies according to your normal retention rules when finished.

If the restore fails, do not mark the backup system as ready. Write down the error, correct the configuration or permissions, and repeat the same test. If you are handling regulated, sensitive or client-owned data, involve the appropriate administrator before changing backup destinations or permissions.

Copy this one-page backup and restore test log

You can paste the following into a private document, spreadsheet or project note. Keep it in a location you can still access if the main device is unavailable; do not put passwords or recovery codes in this log.

BACKUP & RESTORE CHECK
Date / reviewer:
Business system or folder:
Data owner / permitted storage:
Primary location:
Independent backup location:
Backup schedule / last completed:
Retention or version-history limit:
Test file (non-sensitive):
Restore destination (separate folder):
Steps followed / provider instructions:
File opened and contents checked? Yes / No
Previous version recoverable? Yes / No / Not tested
Time to restore:
Result: PASS / FAIL / PARTIAL
Problem and next action:
Next test date:

PASS means the particular file and recovery path worked in this test. PARTIAL means something restored but the expected content, version or permission did not. Neither label is a guarantee of full-system recovery. If you use a website backup plugin, document a separate test for the database and site files in a safe staging environment with technical help as needed.

A fictional example: the freelancer whose laptop stops working

Imagine a freelance designer preparing a website handoff. The laptop becomes unusable on Thursday afternoon. The client needs the final approved design, the signed scope and a record of what remains to be delivered by Friday.

In this fictional scenario, the designer’s inventory shows that current design files are synced to a cloud folder, the scope is stored in email, and invoices live in a bookkeeping app. A second encrypted backup contains the design folder, but the designer has never tested restoring from it. The cloud folder might be enough to resume work, yet it does not answer what happens if the account itself is locked or an older approved version is needed.

A sensible first response is to use a trusted replacement device, regain access through documented account recovery, retrieve the current approved deliverable, and verify it opens. The designer should then check the signed scope and handoff list before contacting the client with a realistic delivery update. After the immediate work is safe, the backup test should cover an earlier file version and a copy that is independent of the synced account.

The lesson is not that a particular service saved the day. It is that the order of recovery matters: know the essential files, preserve the approved version, verify what you can actually open, and communicate a confirmed plan rather than guessing.

Set recovery priorities you can explain in one sentence

Two useful planning questions are: how much recent work could you afford to lose? and how long could this system be unavailable before client work stops? Larger organisations call these recovery point and recovery time objectives. You do not need to use those terms with a client, but you should know your answers.

Item	Example priority	First recovery check
Active client deliverables	Needed for next agreed handoff	Can the latest approved version be opened?
Client contact and scope records	Needed to coordinate recovery	Can you access the correct contact and contract?
Invoice records	Needed for upcoming payment work	Can you export the relevant report?
Archived marketing assets	Often less urgent	Can you restore a sample later?

These are illustrative priorities, not universal deadlines. A business that processes orders all day may need a much shorter recovery window than a consultant updating a report once a week. For websites, remember that a backup of media files alone may not restore posts, settings or form data. The small-business SOP guide explains how to document a repeatable procedure without creating a giant manual.

What to check for cloud apps, WordPress and external drives

Cloud documents and email

Confirm which folders are covered, who owns them, what happens after a user is removed, and how far back version history goes. If the provider offers an export, test that the export is readable in an application you actually have. An exported archive that cannot be opened is not a useful recovery path.

WordPress websites

Confirm that your backup includes both the database and necessary site files, and that you have access to hosting, domain and recovery instructions. Test restoration on staging or a disposable environment where possible; do not replace a functioning live site just to check a backup. Record any plugin licenses or service dependencies needed after recovery. This is related to the ownership checks in sharing freelancer access without passwords.

External drives

Check the last backup date, encryption, cable or adapter availability, and whether the drive can be read by a replacement computer. Store it securely and disconnect it when the backup process does not need it. A drive that stays permanently attached may be exposed to some of the same threats as the main device.

Five backup mistakes that deserve a second look

Counting copies without checking independence. Two folders in the same synced account may not protect against account loss.
Testing only that a backup job ran. A green status does not prove a file opens after restoration.
Forgetting the recovery login. A backup stored behind an account you cannot regain access to is hard to use in an emergency.
Saving too much client data. Unnecessary duplicate records can create privacy and contractual problems.
Never revisiting the inventory. A new invoicing tool, website host or client workspace can leave yesterday’s backup plan incomplete.

A realistic maintenance routine for one person

Keep the recurring work small enough that it actually happens. After a new project or system is added, update the inventory. On a regular cadence appropriate to your risk, review backup-job results and restore one harmless representative file. After a major migration or provider change, repeat the test from the new location. If you have complex websites or databases, plan a separate technical restore exercise rather than treating the sample-file test as sufficient.

Use a simple reminder in your existing planning system, not a new dashboard. The aim is to make recovery boring: one inventory, a tested path, a dated result, and a clear next action. You can add the check to the same recurring review that covers client handoffs and account access.

Small business backup checklist: the five-minute version

List the five business records you would need first after losing your laptop or cloud account.
Identify one backup copy that is not vulnerable to exactly the same failure as the primary copy.
Check retention, encryption and who can access recovery instructions.
Restore one non-sensitive sample file into a separate folder and open it.
Record PASS, PARTIAL or FAIL, fix what failed, and choose the next test date.

Backing up data is not the same as being ready to recover it. A short, honest restore test gives you something more useful than a reassuring icon: evidence that one important recovery path works, plus a list of what still needs attention.