Automated Backups for SMBs: How It Works, What It Costs

Automated backup is a system that copies your business's files, databases, and cloud data on a recurring schedule without anyone needing to remember to run it, storing multiple versions across different locations so a single point of failure can't destroy your only copy. Done properly, it follows the 3-2-1 rule — three copies of your data, on two different types of storage, with one copy offsite — and for a typical Canadian small business, the whole thing runs somewhere between $50 and $500+ CAD a month depending on how much data you have and how quickly you need to recover it.

We wrote this guide because we still, in 2026, regularly meet business owners who believe they have a backup strategy when what they actually have is a folder someone copies to a USB drive every few weeks, or an assumption that Microsoft 365 or Google Workspace is "handling it" automatically. Both of those beliefs are common, and both are wrong in ways that only become obvious at the worst possible moment — during an actual data loss event. This article walks through why manual backup habits fail, exactly how automated backup systems work under the hood, how the main provider categories compare, what ransomware changes about the picture, and what you should realistically budget in Canadian dollars.

Why Manual Backups Fail Small Businesses

Manual backup — someone plugging in an external hard drive, dragging a folder over, and unplugging it again — fails for the same handful of reasons in almost every small business we've worked with, and none of them are really about the technology. They're about human behaviour under normal, everyday pressure.

The first and most common failure is simply forgetting. A backup that depends on a person remembering to do it, on top of everything else that person is responsible for on a given day, will eventually get skipped — not out of carelessness, but because a customer call, a deadline, or a normal busy afternoon takes priority, and "I'll do the backup tomorrow" quietly becomes a habit. We've seen businesses discover their "weekly" backup routine had actually lapsed for two or three months by the time they needed it.

The second failure is inconsistency. Even when someone is diligent about it, manual backups tend to happen at irregular intervals, cover an inconsistent set of files, and skip whatever wasn't top-of-mind that day — a new project folder that didn't exist during the last backup, a database that lives somewhere other than the usual shared drive, or a laptop that was at home instead of the office when the external drive made its rounds.

The third, and arguably most dangerous, failure is that a manual backup is almost always a single point of failure by design. An external hard drive that sits on the same desk as the computer it's backing up will be stolen in the same burglary, damaged in the same fire or flood, and encrypted in the same ransomware attack as the original data, because it's connected to the network (or the same USB port) most of the time. A backup that shares every risk with the thing it's supposed to protect isn't really a backup at all — it's a second copy of the same vulnerability.

Automated backup solves all three problems at once, structurally rather than through willpower. Once configured, it runs on a schedule that doesn't depend on anyone remembering. It covers a defined, consistent scope of data every time, rather than whatever someone happened to think of. And a properly designed automated system keeps at least one copy physically and logically separated from your main systems, so it can survive an event that destroys everything at your primary location.

The 3-2-1 Backup Rule, Explained With a Real Example

The 3-2-1 rule has been the working standard in data protection for well over a decade, and it survives because it's simple enough to actually implement and specific enough to close the real gaps that cause data loss. It states that you should have:

• 3 copies of your data — the original, working copy, plus two backups. Not one backup "just in case," but two, because a single backup is still a single point of failure if something happens to it specifically.
• 2 different types of media or storage — not two backups sitting on the same type of drive, in the same server rack, running the same software. Different storage types fail in different ways, so diversifying protects against a failure mode that would take out both copies at once.
• 1 copy offsite — physically or at least logically separated from your main location, so a fire, flood, theft, or building-wide incident at your office can't touch it.

Here's what that looks like in practice for a real small business — say, a 20-person accounting firm in Ontario running a shared file server and a practice-management database:

Notice what makes this genuinely resilient: no single bad day — a hardware failure, a break-in, a fire, or a ransomware infection that spreads across the local network — can destroy all three copies simultaneously, because they don't share the same storage type or the same physical location. That's the entire point of the rule, and it's why security frameworks, cyber insurance underwriters, and IT compliance standards continue to reference it directly rather than something more elaborate.

How Automated Backup Systems Actually Work Under the Hood

It's worth understanding the mechanics here, because the technical details determine how fast you can recover, how much you'll pay, and how resilient the setup really is against ransomware specifically.

Agents and clients

Most automated backup systems work through a small piece of software — an "agent" — installed on each server or workstation that needs to be protected. The agent runs quietly in the background, watches for scheduled backup windows, identifies which files or blocks of data have changed, and transmits that data to the configured storage target. Some solutions instead work at the network or hypervisor level, capturing entire virtual machine images without needing an agent inside each individual system — this is common with appliance-based business backup and disaster recovery (BDR) solutions.

Scheduling and backup windows

Rather than a person deciding when to back up, the software runs on a defined schedule — commonly nightly full or incremental jobs for file servers, and much more frequent (sometimes near-continuous) incremental snapshots for systems where losing even an hour of data would be costly, such as a database behind an active e-commerce store. Good systems also let you define a "backup window" — a time range, often overnight, when the job is allowed to run so it doesn't compete with production traffic or slow down staff during business hours.

Full, incremental, and differential backups

A full backup copies every selected file every time it runs. It's the simplest to restore from (one copy, everything's there) but the slowest to create and the most expensive in storage. An incremental backup copies only what changed since the last backup of any kind, which is fast and storage-efficient, but a full restore means reassembling the last full backup plus every incremental since, in the correct order — more moving parts, though modern software automates this reassembly. A differential backup copies everything changed since the last full backup (not since the last differential), landing in between: more storage than incremental, but a simpler two-step restore (last full plus latest differential). Most SMB-grade systems today default to frequent incrementals combined with periodic full backups, or "synthetic fulls" that the software builds automatically by merging incrementals together without re-transferring everything from the source system.

Versioning and retention policies

A backup that only keeps the most recent copy protects you against hardware failure but not against something that corrupts or encrypts data gradually — including ransomware that sits undetected for days before triggering. Versioning keeps multiple historical snapshots (hourly, daily, weekly, monthly) so you can restore to a specific point in time before the problem occurred, not just the most recent (potentially already-compromised) state. A retention policy defines how long each version is kept — for example, hourly versions for 48 hours, daily versions for 30 days, and monthly versions for a year — balancing how far back you can go against how much storage you're paying for.

Encryption in transit and at rest

Properly built automated backup encrypts data twice: once while it's being transmitted from your systems to the backup storage ("in transit," typically using TLS, the same technology that secures online banking), and again once it's sitting in storage ("at rest," typically AES-256), so that even if the storage itself were somehow accessed without authorization, the data inside would be unreadable without the encryption key. For businesses handling client financial, health, or legal data, encryption at rest and in transit isn't optional — it's frequently a baseline expectation under Canadian privacy law and cyber insurance policy requirements alike.

Backup verification and test restores

The most overlooked piece of the entire system is verification — actually confirming that a completed backup job produced a file that can be restored and opened correctly, rather than just checking that the job finished without an error message. Many backup failures are silent: a job reports success while quietly backing up a corrupted or empty file, a permissions issue skips certain folders without flagging it clearly, or a database backup completes while the database itself was in an inconsistent state. Good automated systems run automated integrity checks and, ideally, periodic automated test restores in an isolated environment. Nothing, however, fully replaces a real human occasionally restoring an actual file or system to confirm it works — a habit covered in more detail in the self-check section below.

Backup Targets and Provider Categories: Pros and Cons

There is no single "best" backup provider — the right choice depends on how much data you have, how fast you need to recover, your budget, and how technical your team is. Here's how the main categories actually compare.

Cloud-only backup services

Services in this category (Backblaze and Acronis are widely used examples, alongside many managed IT providers offering their own branded cloud backup) install an agent on your servers and workstations and send encrypted backups directly to the provider's cloud storage — no on-premise hardware required. The upside is simplicity and low upfront cost: no appliance to buy or maintain, and pricing is usually predictable per device or per terabyte. The downside is recovery speed for large restores. Pulling several hundred gigabytes or terabytes back down over a typical business internet connection can take many hours to a few days, which matters a great deal if a full server needs to come back online quickly.

On-premise NAS plus cloud hybrid

This setup backs up to a local network-attached storage device first, then syncs that NAS to a cloud target as the offsite copy. It gives you the best of both speeds — fast local restores for the common case (a deleted file, a failed drive) and offsite protection for the worst case (a site-wide disaster) — at a moderate cost. The trade-off is that it requires slightly more setup and ongoing maintenance than a pure cloud service, and the NAS itself is another piece of hardware that can eventually fail and need replacing.

Managed backup and disaster recovery (BDR) appliances

Solutions in the style of Datto or StorageCraft (now part of Arcserve) use a dedicated on-premise appliance that takes frequent, image-based snapshots of entire servers, replicates those snapshots to the cloud automatically, and — critically — can "spin up" a virtual copy of a failed server directly on the appliance or in the cloud within minutes, letting your business keep operating while the physical server is repaired or replaced. This is the fastest recovery option by a wide margin and the strongest against ransomware, since many of these appliances offer built-in immutable, air-gapped cloud copies specifically designed to survive an attack that compromises the rest of the network. It's also the most expensive category, and generally makes the most sense once a business is running one or more servers that genuinely can't be down for more than a few hours.

Why Microsoft 365 and Google Workspace native retention is NOT a real backup

This is the single most common and most expensive misunderstanding we run into. Microsoft 365 and Google Workspace both include some native retention — deleted-item recovery windows, version history on individual files, and admin-level retention policies — and many business owners reasonably assume this means their email and files are "backed up" simply by being in the cloud. They aren't, in the sense that actually matters. Native retention is built for short-term accidental deletion, typically 30 to 93 days depending on configuration, not for long-term recovery, and it has real gaps: a deliberately or maliciously deleted user account can take mailbox data with it beyond the retention window, a ransomware variant that syncs through OneDrive or Google Drive can propagate encrypted versions faster than native version history can be relied on to unwind cleanly, and neither Microsoft nor Google accepts responsibility for data loss under their own terms of service — both explicitly describe backup as the customer's responsibility under what's widely referred to as the "shared responsibility model." A dedicated Microsoft 365 or Google Workspace backup add-on takes independent, immutable, point-in-time copies of mail, files, calendars, and Teams or Shared Drive content, stored completely outside Microsoft's or Google's own infrastructure, closing this gap for a modest per-user monthly cost.

Ransomware-Specific Backup Considerations

A standard 3-2-1 setup is a strong baseline, but ransomware specifically changes the calculation in ways worth understanding on their own.

Why attackers target backups first

Modern ransomware operators know that a business with a clean, working backup has far less incentive to pay a ransom, so a significant share of attacks now include a deliberate phase — sometimes lasting days — where the attacker moves through the network specifically hunting for backup software, backup storage, and admin credentials tied to the backup system, disabling or encrypting them before triggering the main encryption event against production data. If your backup is reachable from the same network, using the same admin credentials, as the systems it's meant to protect, it is a direct target, not a safe fallback.

Immutable and air-gapped backups

Immutable storage means a backup, once written, cannot be modified or deleted for a defined retention period — not by a regular user, not by an administrator account, and not by ransomware that has compromised an administrator account, since the immutability is enforced at the storage layer itself rather than through permissions that a compromised login could simply override. Air-gapped (or logically isolated) backups take this further by keeping a copy disconnected from the network entirely, or accessible only through a separate, tightly controlled authentication path, so that even a fully compromised network can't reach it. For any business that has genuinely thought through ransomware risk, at least the offsite copy in a 3-2-1 setup should be immutable, air-gapped, or both — this is increasingly a baseline requirement from cyber insurance underwriters as well, not just a nice-to-have.

Testing restores regularly

None of the above matters if a real restore has never actually been attempted. We cover this in more detail in the self-check section below, but it deserves emphasis here specifically in the ransomware context: an untested backup that turns out to be corrupted, incomplete, or itself encrypted is discovered at the single worst possible moment — during an active incident, with the business already offline and the clock running on lost revenue.

Real-World Scenarios: What Backup Gaps (and Good Backups) Actually Cost

These three scenarios are illustrative composites built from patterns we've seen repeatedly across Canadian small businesses — not specific named clients — but the numbers reflect realistic ranges for each situation.

Is Your Backup Strategy Actually Protecting You? Quick Self-Check

Run through this list honestly. If you can't confidently check off most of these, your current backup setup likely has a real gap worth addressing before it's tested by an actual incident.

• ☐ Do you have an offsite or cloud copy of your data that is physically separate from your main network?
• ☐ Have you actually performed and confirmed a full test restore in the last 6 months?
• ☐ Is at least your offsite backup immutable or air-gapped against a ransomware attack that compromises administrator accounts?
• ☐ Do your backups run automatically, on a schedule, without depending on any one person remembering?
• ☐ Do you know, in hours, roughly how long a full restore of your most critical system would actually take?
• ☐ Is more than one person capable of triggering a restore if your usual IT contact is unavailable?
• ☐ Are your Microsoft 365 or Google Workspace mailboxes and files included in a real backup, not just native retention?
• ☐ Do you maintain at least three copies of critical data across two or more different storage types?
• ☐ Are backup job logs actually reviewed periodically for failures, rather than assumed to be running correctly?
• ☐ Would your business survive losing the last 24 to 48 hours of data permanently, without serious financial or operational harm?

What Should a Canadian SMB Budget for Automated Backup

Pricing scales primarily with data volume, number of systems, and how fast you need to be able to recover — not simply headcount, though headcount is a reasonable rough proxy for most SMBs. Here's a realistic breakdown in Canadian dollars.

Under 10 employees, under roughly 500GB of data

Most very small offices can get solid 3-2-1 protection with a cloud-only service or a simple NAS-plus-cloud hybrid for $50 to $150 CAD per month. If Microsoft 365 or Google Workspace is central to daily operations, add a per-user backup add-on at roughly $3 to $8 CAD per user per month on top of that.

10 to 50 employees, multiple servers, 1–5TB of data

This is where a hybrid setup or an entry-level managed BDR solution typically becomes the right fit, generally landing in the $150 to $500 CAD per month range, often bundled as part of a broader managed IT services agreement rather than billed as a completely standalone line item.

50 to 100 employees, several servers, 5–20TB+ of data

At this size, businesses typically need a fully managed BDR appliance with automated cloud replication, immutable retention, and faster recovery time objectives, generally budgeting $500 to $1,500 CAD per month or more, scaling with total data volume, the number of protected servers, and how aggressive the recovery time requirement is.

In every size range, the number that matters most isn't really the monthly backup cost — it's that cost measured against the cost of downtime. A single day of lost operations for even a modestly sized business frequently exceeds an entire year of a properly sized automated backup subscription, which is the core economic argument for treating this as a fixed operating cost rather than a discretionary expense to defer.

Canadian Government Resources for Backup and Data Protection Planning

A few Canadian federal resources are directly useful when planning or justifying a backup upgrade, particularly if you need to make the case internally or to a lender.

• BDC (Business Development Bank of Canada) — BDC offers financing and advisory services that many small businesses use to fund IT infrastructure upgrades, including backup and disaster recovery systems, alongside general guidance on technology investment planning for growing businesses.
• Canadian Centre for Cyber Security — Operating under Innovation, Science and Economic Development Canada (ISED), the Cyber Centre publishes free, practical guidance specifically aimed at small and medium businesses on backup best practices and ransomware resilience, including baseline recommendations that align closely with the 3-2-1 approach covered in this guide.
• Office of the Privacy Commissioner of Canada — The OPC oversees obligations under PIPEDA, including data retention and breach-response requirements that directly intersect with backup strategy: how long you retain data, how quickly you can restore it, and how you document your safeguards all matter if your business ever needs to respond to a privacy breach involving backed-up personal information.

How to Set Up Automated Backups Following the 3-2-1 Rule

If you'd rather have this designed and monitored by someone who does it daily, our what to do in the first 24 hours after a ransomware attack guide covers the incident-response side, and IT Cares can set up and manage a properly automated 3-2-1 backup system for your business, sized correctly to your data volume and recovery needs rather than a one-size-fits-all package.

Frequently Asked Questions