Data Backup Best Practices for Perth Small Businesses

Your business data is one of your most valuable assets — and one power surge, ransomware attack, or hard drive failure away from disappearing forever. For Perth small businesses, the question is not if you will need to restore from a backup, but when. Yet the Australian Cyber Security Centre (ACSC) reports that the majority of Australian small businesses still do not have a tested backup strategy in place. They are one incident away from catastrophic data loss.

This guide covers everything Perth business owners need to know about data backup best practices — from the foundational 3-2-1 rule to modern immutable backup strategies, with practical steps you can implement this week.

Why Backup Matters for Perth Small Businesses

Running a small business in Perth comes with its own set of risks. Our Mediterranean climate brings summer storms, bushfire threats, and occasional power outages. A burst pipe above a server room, a lightning strike near your office, or a simple hard drive failure in a five-year-old NAS can take critical business data offline in seconds. Unlike enterprise organisations with dedicated IT teams and off-site data centres, most small businesses lack the internal resources to recover from significant data loss without outside help.

But the biggest threat today is ransomware. Ransomware attackers specifically target backups. Modern ransomware strains are designed to find and encrypt backup files, delete shadow copies, and compromise backup repositories before triggering the main encryption payload. A backup strategy designed five years ago — a single external hard drive connected to your server — is not just inadequate; it is actively dangerous, because it gives you a false sense of security.

Proper backup practices are also increasingly a requirement for cyber insurance. Most Australian cyber insurers now mandate specific backup controls — immutable backups, regular restore testing, and off-site copies — before they will issue a policy. Without evidence of a robust backup strategy, your business may be declined coverage or face significantly higher premiums. Our backup and disaster recovery services at Stride IT are built to meet these requirements and give Perth businesses genuine data resilience.

The 3-2-1 Backup Rule: Still the Gold Standard

The 3-2-1 backup rule has been the foundation of data protection for decades, and it remains just as relevant today — though with a modern twist to account for ransomware. The rule is simple:

• 3 copies of your data — One primary copy (what you work on daily) and two backups. If any single copy is lost, you still have two others.
• 2 different media types — Do not store both backups on the same type of device. For example, one copy on a local NAS and another in the cloud. This protects against media-specific failures — a NAS hardware fault cannot destroy your cloud backup.
• 1 off-site copy — At least one backup must be physically separate from your primary location. If your office suffers a fire, flood, or theft, the off-site copy ensures your data survives. Cloud storage is the most practical off-site destination for most small businesses.

The modern addition to this rule is immutable backups — backup copies that cannot be modified, encrypted, or deleted by anyone, including an administrator, for a set retention period. Immutable backups are the single most effective defence against ransomware because even if an attacker gains full access to your backup system, they cannot alter the immutable copies. This is why the ACSC specifically recommends immutable backups as a critical control for organisations of all sizes.

What Should You Back Up?

A common mistake among small businesses is backing up only obvious files — documents and spreadsheets — while leaving critical business systems unprotected. A comprehensive backup strategy covers:

• File servers and network shares — All shared documents, templates, client files, and project data stored on on-premises servers or NAS devices. These are typically the largest data stores and the most commonly backed up — but also the most commonly forgotten when staff create local working copies on their laptops.
• Line-of-business applications — Your accounting software (Xero, MYOB, QuickBooks), practice management systems, CRM, and any industry-specific applications. Many of these use local databases that need application-aware backup — not just file-level copy.
• Email and collaboration platforms — Microsoft 365 data (Exchange Online mailboxes, SharePoint, Teams) is not automatically backed up by Microsoft. The platform has built-in resilience, but it does not protect against accidental deletion by a user, a disgruntled employee wiping data on departure, or a ransomware attack that syncs encrypted files through OneDrive. You need a third-party backup for Microsoft 365.
• Databases — Any database running locally (SQL Server, Access, FileMaker, custom applications) needs transaction-consistent backups. Simple file-level copy of a running database often produces a corrupted restore.
• Website and e-commerce data — If your business runs a website with customer orders, user accounts, or content managed through a CMS, the database and file assets need regular backups. This is especially important for e-commerce sites where order data is irreplaceable.
• Configuration and system state — Server configurations, firewall rules, router settings, and application configurations. Restoring data onto a misconfigured server is slow and error-prone. Back up the configuration alongside the data.

Backup Frequency: How Often Is Enough?

The right backup frequency depends on how much data your business can afford to lose — your Recovery Point Objective (RPO). For most Perth small businesses, a practical approach is:

• Daily backups — For file servers, databases, and application data. Run during off-peak hours (overnight) to minimise performance impact. Most businesses can tolerate up to 24 hours of data loss, making daily backups the minimum standard. But for many, that gap is too wide — losing an entire day's work on a busy Monday could set you back significantly.
• Hourly or continuous backups — For critical systems where even a few hours of data loss is unacceptable. Accounting systems during end-of-month processing, e-commerce order databases, and client-facing portals all benefit from more frequent backup intervals. Modern backup solutions make this practical without consuming excessive storage by using incremental backups after the initial full backup.
• Real-time replication — For mission-critical systems that must be restored with zero data loss. This typically involves synchronous replication between two storage systems and is usually reserved for enterprise environments. Most small businesses achieve sufficient protection with daily backups plus hourly incrementals.

Your Recovery Time Objective (RTO) — how quickly you need to be back up and running — also matters. If restoring your entire file server takes 48 hours but your business grinds to a halt without it, you need a faster restore solution. Modern backup platforms offer granular restore capabilities: you can restore a single accidentally deleted file in minutes without restoring the entire server. This makes frequent backups practical — you get the safety net without the downtime.

Ransomware-Proofing Your Backup Strategy

Ransomware has evolved. Modern attacks do not just encrypt your primary data — they actively target backup systems. The ACSC's Essential 8 framework specifically addresses this with two key mitigation strategies: regular backups (Mitigation 5) and the use of immutable or offline backups.

Here is how to ensure your backups survive a ransomware attack:

• Immutable backups — Choose a backup platform that supports object lock or Write Once Read Many (WORM) storage. Once written, the data cannot be changed or deleted for a defined retention period — not by an administrator, not by ransomware, not by anyone. Cloud backup providers like Wasabi, Backblaze B2, and AWS S3 with Object Lock all support immutability.
• Air-gapped backups — Keep at least one backup copy that is not continuously connected to your network. A removable drive stored in a secure off-site location, or a cloud backup that requires separate credentials to access, provides an air gap. During a ransomware attack, if the backup system uses the same domain credentials as your production environment, attackers pivot from the primary environment to the backup system. Separate credentials and preferably a separate Microsoft tenant are essential.
• Least-privilege access for backup systems — The accounts that manage backups should not be the same as daily user accounts. Use dedicated backup service accounts with minimal permissions. Enable multi-factor authentication on backup system access.
• No domain-joined backup repositories — If your backup storage is joined to your Active Directory domain, a ransomware attacker who compromises a domain controller can access and encrypt the backups. Keep backup repositories on a separate network segment with restricted access.

The ACSC recommends that organisations maintain at least three copies of their data, with one copy offline or immutable and one copy stored off-site. This aligns with the 3-2-1 rule but explicitly adds ransomware resilience as a design requirement. Our backup and recovery services implement these controls for Perth businesses, ensuring your data survives even a determined ransomware attack.

Cloud vs Local Backup: What's Best for Your Business?

The best backup strategy uses both local and cloud backups — not one or the other. Here is how they compare and why you need both:

Local Backups (NAS, External Drives, Tape)

Local backups offer the fastest restore speeds. Restoring 500GB of data from a local NAS over a gigabit network takes minutes to hours. Restoring the same data from the cloud over a 50Mbps NBN connection could take days. Local backups are essential for rapid recovery of large datasets. However, local backups are vulnerable to the same physical threats as your primary data — fire, flood, theft, power surge — and they are equally vulnerable to ransomware if connected to your network continuously.

Cloud Backups

Cloud backups provide the off-site copy that protects against physical disasters. They also offer immutability, versioning, and geo-redundancy — your data is stored across multiple Australian data centres. Cloud backup providers handle infrastructure maintenance, encryption, and compliance certifications. The trade-off is restore speed: while granular file restores from cloud backups are fast (often minutes), full-server restores depend on your internet connection speed. For Perth businesses, choosing a backup provider with Australian data centres is critical for both performance and compliance with the Privacy Act 1988.

A hybrid approach — local backups for fast recovery plus cloud backups for off-site protection and immutability — gives you the best of both worlds. This is the model the ACSC recommends and the approach we implement in our managed backup solutions for Perth clients.

Testing Your Backups: The Most Overlooked Step

A backup you have never tested is a wish, not a plan. The ACSC recommends quarterly restore testing as a minimum for Australian businesses. Yet in our experience working with Perth SMEs, fewer than one in five have ever performed a full restore test. They assume the backup is working because the software says it is — until the day they actually need it and discover the backup was corrupt, incomplete, or misconfigured.

A proper restore test verifies three things:

• Data integrity — When you restore individual files, are they readable and complete? A backup that completes with "success" status can still have corrupt files that fail to open after restore.
• Restore speed — How long does it actually take to restore a single file, a folder, and a full server? Document these times so you know your true RTO.
• Application functionality — After restoring a database or line-of-business application, does it actually work? Do all features function correctly? Are permissions intact?

We recommend testing the process, not just the data. Simulate a real disaster scenario: disconnect the primary server and attempt to restore operations using backups alone. Document every step that fails or takes longer than expected, then fix those gaps. Your backup strategy should be a living document, reviewed and tested regularly.

Backup for Microsoft 365: A Common Blind Spot

Many Perth businesses assume that because their email and files live in Microsoft 365, Microsoft is responsible for backing them up. This is not correct. Microsoft operates under a shared responsibility model: they ensure the platform itself is available and resilient, but protecting your data within the platform — against accidental deletion, malicious insider threats, ransomware that syncs through OneDrive, or legal hold requirements — is your responsibility.

The default Microsoft 365 retention and recovery capabilities are limited. Recycle bins in Exchange Online and SharePoint retain deleted items for 30 to 93 days depending on your licence tier, but they do not protect against ransomware that gradually encrypts files over weeks (allowing the encrypted versions to replace clean versions across all sync clients before anyone notices). A dedicated third-party backup solution for Microsoft 365 — one that captures point-in-time snapshots of mailboxes, SharePoint sites, Teams, and OneDrive — is essential for any business using the platform.

For Perth businesses moving to cloud-based productivity, integrating Microsoft 365 backup into your broader backup and disaster recovery strategy ensures no part of your data environment is left unprotected.

Getting Started: A 7-Day Action Plan for Perth Businesses

You do not need to overhaul everything overnight. Here is a practical week-by-week action plan to bring your backup strategy up to standard:

• Day 1: Audit what you currently back up — List every data source: file servers, databases, Microsoft 365, line-of-business applications, websites. Compare against the checklist above. What is missing?
• Day 2: Check your backup software's immutability settings — Does your backup platform support immutable backups? Are they enabled? If not, start researching solutions that do — this is your highest-priority gap.
• Day 3: Verify your off-site copy — Do you have at least one backup copy physically separate from your office? If it is cloud-based, verify it is actually completing successfully (do not trust the dashboard — check the logs). If it is a drive you take home, ensure it is encrypted and the encryption key is documented.
• Day 4: Test a single file restore — Pick an important file and restore it from backup. Time how long it takes. If the restore fails or the file is corrupt, you have found a critical gap that needs immediate attention.
• Day 5: Review your backup schedule — Does it match your RPO? If losing a day's work is unacceptable, increase backup frequency. Most modern backup solutions can do hourly incrementals with little extra storage cost.
• Day 6: Document your recovery procedures — Write down the steps to restore from backup for each critical system. Include contact details for your IT provider or backup software support. Store this document outside your network (print it, keep it in a safe).
• Day 7: Plan your quarterly restore test — Schedule the first full restore test. Pick a weekend, involve your IT team or provider, and simulate a real disaster scenario. Document the results and fix any issues found.

If any of these steps reveal gaps — and they almost certainly will — a professional backup and disaster recovery assessment can help you close them efficiently. For Perth businesses, the cost of implementing proper backups is a fraction of the cost of recovering from data loss.

Key Takeaways

• Follow the 3-2-1 rule: three copies, two media types, one off-site — with the modern addition of immutable backups for ransomware resilience
• Back up more than just file servers: databases, Microsoft 365, line-of-business applications, and system configurations all need protection
• Test your backups quarterly — a backup that has never been restored is a risk, not a safety net
• Immutable backups and least-privilege access to backup systems are essential defences against modern ransomware
• Microsoft 365 is not automatically backed up — you need a dedicated third-party solution for Exchange Online, SharePoint, Teams, and OneDrive
• A hybrid local + cloud backup approach delivers both fast recovery and off-site protection
• Regular backup testing and documentation are as important as the backup technology itself

Your business data is the lifeblood of your operation. A proper backup strategy — tested, immutable, and off-site — is not an IT expense; it is an insurance policy against the worst day your business could face. The week you spend implementing these practices is the best investment you can make in your business's continuity.

Stride IT is a Perth-based managed IT and cyber security provider helping local small businesses implement resilient, ACSC-aligned backup and disaster recovery strategies. Our backup and recovery services are designed for Australian small and medium businesses, with immutable cloud storage, Australian data centres, and regular restore testing. Get in touch for a no-obligation health check of your current backup setup.