How long should your business keep its backups?
Last night's backup is not enough when damage is found weeks later. A practical retention schedule, what records rules mean, and how to protect older copies.
Most small businesses can say whether they have a backup. Far fewer can answer the next question: how far back can you go? If a file was damaged three weeks ago and nobody noticed, does the backup still hold a good copy, or has it quietly been replaced by the damaged one? That is what backup retention decides, and it is often left at whatever setting the software came with.
Why "last night's backup" is not enough
A backup that only keeps the most recent copy protects you against one kind of problem: something going wrong today and being noticed today. Many real problems don't work like that.
- Slow discovery. Someone deletes a folder of client files in March. Nobody looks for them until the client asks in June. A backup that keeps 30 days no longer has them.
- Ransomware. Attackers are often inside a network for some time before they encrypt anything, and some deliberately target backups. If every retained copy was made after they got in, restoring may simply bring the problem back.
- Silent corruption. A spreadsheet or accounting file can become damaged and still open. Each night, the backup faithfully saves the damaged version.
- Year-end and audit questions. Being asked for the version of a file as it stood on a specific date months ago is routine for accounts, contracts and project files.
A practical retention schedule
A common and sensible pattern keeps many recent copies and fewer older ones. For example:
- Daily backups kept for two to four weeks;
- weekly backups kept for two to three months;
- monthly backups kept for at least a year;
- yearly copies kept for as long as your records require.
This is sometimes called grandfather-father-son retention. Most business backup software can do it with a few settings, and because modern tools only store the changes between copies, keeping a year of monthly versions usually takes far less space than people expect. The exact numbers matter less than having an answer you chose on purpose and wrote down.
How long you have to keep records is a separate question
Some records, such as tax, payroll, health or client files, have legal or contractual retention periods that vary by industry and by state. Those rules are about the records themselves, not about your backups, and your accountant or attorney is the right person to confirm them. What your IT setup needs to do is make sure the retention you choose for backups and archives is at least as long as those obligations, and that old backups are deleted securely once they are no longer needed. Keeping everything forever is not free either: it can mean holding personal data longer than you should.
Don't forget Microsoft 365 and other cloud apps
Email, OneDrive, SharePoint and Teams have recycle bins and version history, but they are designed for undoing recent mistakes, not as a long-term backup. Deleted items are eventually purged, and if an account is removed when someone leaves, its data goes with it after a grace period. If those files matter, a separate backup of Microsoft 365 with its own retention is worth considering, set up with the same schedule thinking as your servers and PCs.
Protect the older copies
Long retention only helps if those older copies survive an attack. Look for:
- Immutable or locked backups that cannot be deleted or changed before their retention period ends, even by an administrator account;
- a copy kept off site or in the cloud, separate from the office network;
- separate credentials for the backup system, so a stolen everyday password does not open it.
Check it once in a while
A retention policy on paper is not the same as copies you can actually restore. Every few months, pick a file and try to restore the version from, say, three months ago. Our guide to running a test restore drill walks through how to do that without disrupting work.
Need a second opinion?
If you are not sure how far back your backups go, our managed backup service can review your current setup, set a retention schedule that fits how your business works, and keep watch on it. It fits naturally into wider disaster recovery planning, and if the worst has already happened, we also handle ransomware recovery. Call (213) 986-4855.