Local Backup: The Unsexy Habit That Saves Your Business

Imagine you are a freelance photographer. You have 12 years of client work on a single external drive. It clicks, spins down, and never spins up again. You have no second copy. That is not a backup problem; that is a business-ending problem. The fix is not glamorous, but it is methodical. This walkthrough is for anyone who has a computer, a business, or data they cannot afford to lose. I am going to give you a blunt, step-by-step plan for local backup—the kind that lives on your desk or in your office, not just in someone else's cloud.

My position up front: if you only do one thing, buy two external drives and rotate them. That single habit puts you ahead of most small businesses. But do not stop there. You need to know your numbers, pick the right tools, and test the restore. Otherwise you are just buying hardware and hoping.

1. Define what you cannot lose (and how much)

Before you buy anything, answer two questions. First: what is your Recovery Point Objective (RPO)? That is the maximum amount of data loss you can tolerate, measured in time. If you can lose a day's work, your RPO is 24 hours. If you are running a database that processes transactions, your RPO might be five minutes or less. NIST SP 800-34 defines RPO as the point in time to which your data must be recovered after an outage, given your most recent backup (NIST SP 800-34 Rev. 1). Second: what is your Recovery Time Objective (RTO)? That is the maximum acceptable downtime before you must be back online.

These two numbers drive everything else. Mission-critical systems often need an RTO under one hour and an RPO under five minutes, while less critical systems can tolerate longer gaps (NIST). Write your numbers down. Tape them to your monitor.

2. Follow the 3-2-1 rule, then modernize it

The classic 3-2-1 rule says three copies of your data, on two different media types, with one copy off-site. CISA credits photographer Peter Krogh with coining it, and it remains the baseline. But CISA now recommends a modernized version: 3-2-1-1-0. That adds one immutable or air-gapped copy and zero unverified backups (CISA). Immutable means the data is locked after it is written, so it cannot be altered or deleted—NIST SP 800-209 defines it exactly that way (NIST SP 800-209).

For local backup, your two on-site copies might be an external SSD and a network-attached storage (NAS) device. The off-site copy can be cloud storage or a drive you rotate to a safe deposit box. The immutable copy is the hard part. A plain external drive is not immutable. You need either a drive with WORM (write-once, read-many) capability or an air-gapped drive that you physically disconnect after each backup.

Quick tip: An air-gapped drive that is plugged in 24/7 is not air-gapped. Unplug it when you are done.

3. Choose your backup types and schedule

You have four main choices: full, incremental, differential, and snapshots. A full backup copies everything, which is the most complete but takes the most time and storage. An incremental backup copies only files changed since the last backup of any type, so a restore requires the last full plus every incremental since then. A differential backup copies everything changed since the last full backup, so a restore needs only the last full plus the most recent differential.

Snapshots are not backups. I will say that again: a snapshot is a point-in-time copy that often uses pointers rather than a full physical copy. VMware snapshots, for example, are only a change log of the original virtual disk. If the base disks are deleted, the snapshot files alone cannot restore the virtual machine. VMware recommends using only two to three snapshots in a chain and never keeping a single snapshot longer than 72 hours (Broadcom KB).

For local backup, I recommend a simple schedule: a full backup once a week, differential backups daily, and incremental backups every few hours if your RPO demands it. NIST SP 800-209 suggests specifying tiering, frequency, and number of copies for each tier—for example, 48 hourly snapshots or 30 daily backups (NIST SP 800-209).

Here is a concrete example. Suppose you run a small law office. Your RPO is four hours because you can re-create a half-day of billing entries but not more. Your RTO is eight hours. You buy two 4 TB external SSDs and a NAS. You set the NAS to run a differential backup every four hours and a full backup every Sunday at 2 a.m. You rotate one SSD off-site every Friday. That setup meets your RPO and RTO without a six-figure storage bill.

4. Test the restore—or you have nothing

An untested backup is an assumption, not a backup. NIST SP 800-209 recommends testing backups at least monthly for critical data and performing an end-to-end test restore to a sandbox environment for applications with strict restoration speed requirements. CISA advises maintaining offline, encrypted backups and regularly testing them. NIST SP 800-53 control CP-9(1) requires organizations to test backup information to verify media reliability and information integrity (NIST SP 800-53 Rev. 5).

Here is what can go wrong: you back up to a drive that is always connected. Ransomware encrypts your primary data and then encrypts the backup drive. You have no clean copy. NIST SP 800-209 warns that attackers target backups and may interfere with the backup process itself to poison future copies. CISA's ransomware response checklist tells you to restore from offline, encrypted backups, taking care not to re-infect clean systems. If your only backup was online, you are negotiating with criminals.

So test. Once a month, pick a file—any file—and restore it from your backup. Once a quarter, do a full restore to a spare machine. Time it. If it takes longer than your RTO, fix the process. Keep a recovery catalog that records each copy and the results of anti-malware scans (NIST SP 800-209).

Warning: High availability is not a substitute for backup. NIST SP 800-34 notes that a corruption on one system can propagate through an HA cluster, making recovery impossible without a separate backup (NIST SP 800-34 Rev. 1).

If you want a short list of what to buy first, start here:

• Two external SSDs (one stays connected, one rotates off-site).
• A NAS with snapshot and WORM capability if your budget allows.
• A small fireproof safe for the off-site drive when it is not in transit.

Local backup is not exciting. It is the difference between a bad afternoon and a closed business. Define your RPO and RTO, build the 3-2-1-1-0 stack, automate what you can, and test the restore on a calendar. Do that, and you will sleep better. Skip it, and you are just hoping.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-53 Rev. 5 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
• Broadcom KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html