The NYC Business Owner's Guide to Data Backup That Actually Works

Ask any owner of a 10-40 person NYC business whether their data is backed up, and the answer is nearly always yes. Then we audit, and the same gaps appear, in roughly the same order: the email "backup" is just Microsoft's recycle bin, half the laptops aren't covered, the one real backup hasn't been test-restored since it was installed, and nothing in the chain would survive a ransomware operator who deletes backups before encrypting, which is now standard procedure, not a sophisticated extra.

Backup is a topic where principles do the heavy lifting, because products change and the principles don't. So: five principles first, then the concrete build.

The five principles

1. The 3-2-1 rule didn't die when you went cloud-first

Three copies of your data, on two different platforms, one of them separated from the others. Owners assume moving to Microsoft 365 satisfied this automatically. It didn't, it gave you one very reliable copy. Reliability and recoverability are different promises: Microsoft will almost never lose your data, but it will faithfully sync, retain, and eventually purge whatever your own users (or an attacker with their credentials) delete.

2. Sync is not backup

OneDrive, Dropbox, and Google Drive replicate changes, including the bad ones. Delete a folder, and sync deletes it everywhere with perfect efficiency; let ransomware encrypt a desktop, and sync helpfully uploads the encrypted versions. Versioning and recycle bins soften this for small accidents inside their retention windows, but they're controlled by the same account an attacker compromises. A backup, by definition, is a copy the production credentials can't destroy.

3. Your Microsoft 365 (or Google) data is your responsibility

It's in both providers' terms, the shared responsibility model. They run the service; the data is yours to protect. Defaults that surprise people: a deleted user's OneDrive is gone for good after 30 days (retention configurable, but someone has to configure it), purged mailbox items have finite windows, and none of it helps when the deletion was 60 days ago and the client dispute is today. Third-party M365 backup runs about $3-$6 per user per month, among the cheapest insurance in IT.

4. One copy must be immutable

Modern ransomware crews spend days inside a network before encrypting anything, and their first project is finding and destroying backups. The answer is immutability: a copy written to storage that nobody (not your admin account, not us, not an attacker holding both) can alter or delete until a lock period expires. If every copy you own can be deleted by some credential, you don't have a ransomware backup; you have a ransomware to-do list. (What recovery actually looks like when this goes wrong is in our ransomware recovery plan guide.)

5. The metric that matters is restore time, not backup success

Backup reports tell you copies were made. The business question is: how long until we're working again? A single file should come back in minutes; a mailbox in hours; a full server or a 2 TB SharePoint estate could be a multi-day download if you've never thought about it. Know your recovery time objective before the day it's being measured with the whole company watching.

The implementation: what we actually deploy

Microsoft 365 / Google Workspace

A third-party backup capturing mail, calendars, OneDrive/Drive, SharePoint, and Teams data, 1-3 times daily, with retention set to your real needs, for many NYC firms that's years, not 30 days, especially anywhere within reach of legal or financial recordkeeping rules. This sits alongside, not instead of, sensible retention policies inside Microsoft 365 itself.

Laptops, for a workforce that's everywhere

Your mobile workforce means the office backup never sees half the machines. Two workable patterns: enforce OneDrive Known Folder Move so desktops and documents live in the already-backed-up cloud (our default for most clients, elegant, license-included), or add endpoint backup agents for roles that hoard local data outside synced folders. Either way the test is the same: if a laptop is stolen on the L train tonight, is the answer "wipe it remotely, restore to a new machine by lunch"? With BitLocker plus either pattern, it is.

Servers and NAS devices, if you still have them

Image-based backup (so you can restore the whole machine, not rebuild it), local copy for fast restores plus cloud copy for disasters, and the cloud copy immutable. If the server's days are numbered anyway, sometimes the right move is retiring it instead of backing it up better, that's the calculus in our no-server-room guide.

The quarterly test ritual

An untested backup is a hypothesis. The ritual below takes about an hour a quarter, and it has caught a silent failure (an unmounted drive, an expired credential, a share added but never scoped in) in a meaningful share of first-time audits we've run. We treat it as non-negotiable in our backup & disaster recovery service, and there's a deeper version in our backup testing guide.

What this costs, honestly

For a 15-person cloud-first NYC office: M365 backup around $60-$90 per month, immutable cloud storage for whatever local data remains usually under $100, and the quarterly drill is labor, not licenses. Call it $150-$250 a month, all-in, against a median downtime event that costs more than that per hour once you count idle payroll and missed work. It's one of the few line items in IT where the math isn't even close.

We design, run, and (crucially) test this stack for businesses across the five boroughs, remote-first at New Jersey pricing with onsite visits when hardware's involved; the model is on our NYC IT services page, and backup monitoring is built into every managed IT plan. Want us to run the audit that finds your gaps before an incident does? Book a free IT assessment, more guides on the Setnom blog.