A one-person business runs on a handful of files: your product source files, customer lists, bookkeeping sheet, website content and the drafts you spent months on. Most of us assume they are safe because they live “in the cloud.” Then a laptop dies, an account gets locked, or a bad click deletes a folder, and the assumption gets tested.
A backup plan does not need to be technical or expensive. This post walks through a simple routine built on a rule the US Cybersecurity and Infrastructure Security Agency (CISA) recommends to small businesses, and how to set it up in an afternoon.
Start with what you cannot afford to lose
CISA’s small-business guidance suggests taking inventory of the data you hold and prioritizing what the business cannot operate without. For a solo online business that usually means:
- Product source files: the editable versions of ebooks, templates and courses, not only the exported PDFs.
- Customer and subscriber records, including exports from your email service and storefront.
- Financial records: your income and expense sheet, invoices and tax documents.
- Website content, plus any settings or configuration you would struggle to recreate.
- Passwords and recovery codes, stored in a password manager. See Lock Down Your Business Accounts: Password Managers and MFA for Solo Owners.
Write the list in a note. It is also a good moment to spot data you no longer need and can delete.
The 3-2-1 rule in plain words
CISA describes the rule this way: keep three copies of your important files, on two different types of storage, with one copy stored off-site, away from your business location. Its example pairs a hard drive with cloud storage.
For a home-based business, that might look like:
- Copy one: the working files on your computer.
- Copy two: an external drive that is backed up automatically or on a regular schedule.
- Copy three: a cloud backup or storage account, which doubles as your off-site copy.
The reasoning is that different problems hit different places. A spilled coffee takes out the laptop, a fire or theft could take out everything in the house, and a hacked account could take out the cloud. Keeping copies in different places and on different kinds of storage makes it unlikely that one event wipes out every copy.
Automate it, then forget it
CISA recommends a backup solution that runs automatically and regularly. A backup you have to remember is a backup that stops after three weeks. Most operating systems include a built-in backup feature for an external drive, and many cloud services offer automatic backup for chosen folders. Pick whichever you will actually leave switched on, and check the pricing page of any paid service before you commit, since plans and prices change.
One caution that comes from how syncing works rather than from any single product: a synced folder usually mirrors what you do, including accidental deletions or overwrites. Check whether the service keeps older versions or a trash period, and use a real backup or versioning feature for the files that matter most.
Test a restore
CISA’s guidance includes testing that you can restore data, both fully and partially, and running scheduled recovery tests. You do not need a formal drill. Once a quarter, pick a file you have not touched in months, restore it from each backup and open it. If it opens, you have learned that the whole chain works. If it does not, you have found out while the stakes are low.
Protect the backups themselves
The same guidance mentions physical security, encryption and offline copies. In plain terms: an external drive sitting plugged in all day can be affected by the same malware as your computer, so unplug it between backups if your software allows, and use encryption features for drives or services that hold customer data. Protect cloud accounts with a strong unique password and multi-factor authentication.
If you use AI tools or automations that touch your files, remember that a tool with access to your folders can also change or delete them. Keep your backups outside what those tools can write to. Backup subscriptions deserve a line in your yearly review too: see Run a Software Subscription Audit for Your One-Person Business.
Do this today
Make the inventory list of your five most important files or folders, then check where each one is stored right now. If any lives in only one place, make a second copy today, and put a recurring calendar reminder on the first of next month to test a restore. That takes under an hour.
More on Totally Relentless
- Lock Down Your Business Accounts: Password Managers and MFA for Solo Owners
- Run a Software Subscription Audit for Your One-Person Business
- Track Side-Business Income and Expenses in a Simple Spreadsheet
