A bad day shouldn’t close your business.
Backups that are tested, accounts that are locked down, and a plan for when something goes wrong. Security sized for a small business, explained in plain English.
Prefer texting? Text the same number — most of our clients do.
Scroll to see how it works
01A normal day
Everything running. Backups in the background.
Local and offsite copies of your files and email, with regular test restores. A backup nobody has tested is a guess.
02One click
A fake invoice gets opened.
It only takes one convincing email. That is why we run short, practical phishing training, so your team spots fake invoices and password-reset scams before they click.
03The bad day
Ransomware starts locking files.
Anything it can reach gets encrypted. Multi-factor sign-in, locked-down admin access and watched antivirus are there to stop it getting this far.
04Recovery
The offsite copy is out of reach.
Hacked email, a suspicious payment request, or ransomware: call us first. We contain it and help you recover from the offsite copy.
05Back to work
A bad day shouldn’t close your business.
Backups that are tested, accounts that are locked down, and a plan for when something goes wrong.
An example of how a recovery plays out, not a specific client.
What we set up
Security baseline
Multi-factor sign-in on every account, admin access locked down, antivirus that’s actually watched, and updates on schedule.
Backups we test
Local and offsite copies of your files and email, with regular test restores. A backup nobody has tested is a guess.
Phishing training
Short, practical training so your team spots fake invoices and password-reset scams before they click.
Cyber insurance readiness
Insurers now ask about multi-factor sign-in, backups and endpoint protection. We fill out the questionnaire with you and close the gaps.
Written security plans
Tax preparers and many regulated offices need a written information security plan. We write it in plain English and help you follow it.
When something goes wrong
Hacked email, a suspicious payment request, or ransomware. Call us first; we contain it and help you recover.
The five questions we ask every business
- If your main computer or server died tonight, how long until you’re working again?
- When was the last time someone restored a file from your backup to prove it works?
- Does every email account require a code from a phone to sign in?
- Who still has access that shouldn’t, like former employees or old vendors?
- If a vendor emailed new bank details tomorrow, would your team catch it?
Not sure of the answers? The free IT consultation covers all five.
How we build a backup you can actually recover from
A backup is only worth something on the day you restore from it. We set up backups around a few rules that hold up when a laptop is stolen, a server dies or ransomware gets in.
The 3-2-1 rule
Three copies of your important data, on two different kinds of storage, with one copy kept off site. A single external drive sitting next to the server is one copy, not a backup plan.
A copy attackers cannot change
Ransomware goes looking for backups to encrypt or delete. We keep at least one copy immutable (locked so it cannot be altered for a set period) or offline, out of reach of a compromised account.
Restores we actually test
We restore real files and check them, so we know the copies open and how long a full recovery takes. Monitoring tells us when a job fails; testing tells us the job was worth running.
Microsoft 365 and Google data
Microsoft's built-in retention and recycle bins are short-term and are not an independent backup. We back up mailboxes, OneDrive, SharePoint and Teams separately, using a third-party tool or Microsoft's paid Microsoft 365 Backup add-on, whichever fits.
Servers and line-of-business apps
Accounting, practice management and job-costing data often lives on one server or in one database. We back up the whole machine so it can be brought back, not just the files on it.
Laptops that travel
Files saved on a laptop's desktop are easy to lose. We move work into OneDrive or SharePoint where it is synced and backed up, so a lost laptop is an inconvenience instead of a disaster.
A recovery plan for Central Oregon
Disasters here are rarely dramatic hacks. They are winter storms that knock out power, a wildfire evacuation notice in August, an internet outage that lasts all afternoon, or a server that simply stops booting. A written recovery plan answers the questions you do not want to work out under pressure:
- How long can you be down? We agree on how many hours of downtime and how much lost work you can live with, and size the backups to match.
- What comes back first? Email, the line-of-business app, phones, file shares: the order is written down before anything breaks.
- Where do people work from? If the office is evacuated or dark, can your team work from home or another town with a laptop and an internet connection?
- Who calls whom? Your contact list, your cyber insurer's claim number, key vendors and our number, kept somewhere other than the server that just failed.
- What protects the hardware? Battery backups (UPS units) so servers and network gear shut down cleanly in an outage instead of crashing.
Then we test it. A plan nobody has walked through is a hope, not a plan.
How a backup and recovery project runs
Find the data
We list where your important data really lives: servers, laptops, Microsoft 365, Google, cloud apps, and the one spreadsheet on the front desk computer.
Set the targets
We agree on recovery time and acceptable data loss for each system, in plain terms.
Build and lock it down
Backups set up with off-site and immutable copies, separate credentials and monitoring.
Test and write it up
A real restore, timed, plus a short written recovery plan your team can follow.
On a managed IT plan, backup monitoring and tested restores are part of the monthly service.
Backup and recovery questions
Isn't everything in Microsoft 365 already backed up?
Microsoft keeps its service running and keeps deleted items for a limited time. That is not the same as an independent backup you control. If an account is compromised or files are deleted and the retention window passes, they are gone.
How often should backups run?
As often as the work you would lose matters. Many offices back up at least nightly, with more frequent snapshots for busy file shares or databases. We set it based on your recovery targets.
Can ransomware reach our backups?
It can if the backups are on a mapped drive or use the same admin password as everything else. Immutable and offline copies, plus separate backup credentials, are how we keep a clean copy out of reach.
What should we do first if we think we have been hit?
Where does security fit in?
Backups are your last line of defense. Multi-factor sign-in, endpoint protection, training and security assessments are covered on our cybersecurity services page, and insurance questionnaires on cyber insurance readiness.
Related reading
Find out where you stand
Our free IT consultation tests your backups and security basics, then gives you a short list of what to fix first.
Prefer texting? Text the same number — most of our clients do.