What are backups? Explained with a spare key at a friend's house

In one sentence: A backup is a separate, up-to-date copy of your business data, kept somewhere a problem with the original cannot reach, so you can get your files back after a broken laptop, a stolen phone or a ransomware attack.

The everyday picture

Think about your house keys. Lose them and you are stuck outside. So many people leave a spare key with a friend across town.

Where the spare lives matters. A spare on the same key ring is lost with the original. A spare under the doormat is the first place a burglar looks. A spare at a friend's house is safe from whatever happens at your front door.

It also has to work. If you changed the locks last year and never cut a new spare, the friend is holding a useless key. Backups follow the same rules. Your data is the house, the backup is the spare key, and the friend's house is a copy kept apart from everything else.

How it works, step by step

1. Decide what needs a copy (which doors need a spare). The UK's National Cyber Security Centre lists things like your website, emails, invoices, documents, contacts and customer records. Anything you cannot easily recreate belongs on the list.
2. Make copies automatically and often (cutting a new spare whenever the locks change). Set backups to run on a schedule, not when someone remembers. How often depends on how fast the data changes: New Zealand's government guidance suggests a few times a day for new customer data, and weekly or monthly for a website that rarely changes.
3. Keep at least one copy apart (the spare at the friend's house). Ransomware, software that locks your files until you pay, can also lock backups on drives or cloud folders that stay connected. So one copy should be offline, unplugged or disconnected when not in use, and one should be in a different place in case of fire or flood.
4. Restore when something goes wrong (fetching the spare and opening the door). You copy the data back from the backup onto a working computer or system and carry on.
5. Test the restore regularly (trying the spare in the lock before an emergency). Copies can fail quietly. UK and New Zealand guidance both say to practise restoring, to check the copy is complete and that you know the steps.

Where the picture stops

• A backup is a copy of everything inside, not just a way back in. A spare key only gets you through the door. A backup is a second copy of the contents of the house itself.
• A backup is a snapshot of one moment. Anything created after the last copy is not in it. Many backup and cloud services also keep older versions, so you can go back to a point before a mistake or an attack. One spare key has no history like that.
• More spares are better. With keys, one spare is usually enough. With data, guidance often follows the 3-2-1 rule: at least three copies, on two different devices, with one kept offsite.

Why it matters for your business

• You can recover instead of starting over. A dead laptop or a deleted folder becomes an inconvenience, not a crisis.
• Ransomware loses much of its power. If a clean copy is kept apart from your systems, you can restore it rather than depend on criminals. The UK's National Cyber Security Centre notes that attacks have locked connected backup drives and cloud storage too, which is why the separate copy matters.
• You know who is responsible. If your web host or IT provider runs backups, ask what is copied, how often, how long copies are kept and whether a restore costs extra.

An example

Imagine a five-person design studio. Its files sit on a shared cloud drive, and every laptop is linked to it.

One morning, an infected email attachment locks the files on one laptop. Because the shared drive stays connected, the locked files spread there too. Without a separate copy, the studio would be stuck.

But the studio has a backup service that copies the files every night and keeps older versions. It also copies them weekly to an external drive that is unplugged and kept off-site. The team picks the version from the night before the attack and restores it. They lose a morning of work, not years of client projects. They had practised a restore before, so nobody worked out the steps under pressure.

Frequently asked questions

Is cloud storage the same as a backup?

Not on its own. A shared or linked folder is often permanently connected, so the same mistake or attack can reach it. It becomes a useful backup when copies are kept separately, older versions can be restored and access is protected with 2-step verification.

What is the 3-2-1 backup rule?

Keep at least three copies of your data, on two different devices, with one copy kept offsite. It is a simple way to make sure one problem cannot destroy every copy.

How often should a small business back up?

As often as the data changes and as much as you can afford to lose. Busy customer data may need copying several times a day, while a rarely updated website might only need weekly or monthly copies.

How do I know my backup works?

Restore from it. Try bringing back a few files or a whole system on a regular schedule, and check that everything important is there.

Related explainers

• What is cloud hosting? Explained with a serviced office
• What is scaling? Explained with checkout lanes at rush hour
• Frontend vs backend, explained with a restaurant

The DevDrift sets up cloud hosting with backups and tested restores: see how.

Sources

• UK National Cyber Security Centre: Backing up your data (small organisations guide)
• UK National Cyber Security Centre: Offline backups in an online world
• Own Your Online (New Zealand government): Back up your business data