Data Backup for Contractors: A Practical Business Guide

01Where your estimates, invoices and job photos live

Before anyone sells you a backup, you need to know what you’d be backing up. For most contracting businesses, the files that hurt to lose are estimates, invoices and job photos, and they rarely live in one place.

Each of them sits in one of four places: an office computer, your business cloud account (Microsoft 365 or Google Workspace), a crew phone, or the job software you run projects in. Go through your files, put each one in a place, and write down one person who answers for it. An estimate workbook that only exists on the office manager’s desktop is a different problem from an invoice saved to a shared drive, even if both feel equally “saved.”

CISA’s guide to backing up business data tells small businesses to start by taking stock of their important information and who has access to it. Only your office knows where your estimates sit, so that list has to come from you.

Job photos deserve a closer look. A photo your field lead uploads to a shared folder on your coverage plan can be part of a backup. A photo that never leaves the camera roll depends on a phone that could slide off a tailgate tomorrow. And data inside job software stays with the software company that holds it, unless a written plan says otherwise.

You don’t need special software to track this. A simple spreadsheet works: one row per item, with columns for where it lives and who’s responsible.

02Four kinds of protection

People use the word “backup” for very different things. Four come up most often, and each one protects something different.

A separate copy of the files

CISA defines a backup as a secure copy of your critical data, stored separately from your primary systems. That’s a file backup: a second copy of your estimates and invoices that lives somewhere other than the original, not the live file your office opens every morning. If the only version of a bid is the one you’re editing, you don’t have a backup of it yet.

A computer image

A computer image gets the machine itself running again. It isn’t about your documents. Microsoft says a recovery drive backs up the system files needed to restore a PC toward its original state, including after a drive is replaced, but not your personal files. So a recovery drive won’t bring back an estimate saved on that desktop. For those, Microsoft points to a different method, such as Windows Backup or File History.

Windows Backup is built for personal Microsoft accounts. It backs up folders, themes, settings, many installed apps and Wi-Fi details, syncs the folders you choose to OneDrive, and doesn’t work with work or school accounts. Don’t make it the plan for your office’s Microsoft 365 or Google Workspace files.

Cloud storage and sync

When your office saves to OneDrive or Google Drive, you get the live file plus version history and trash. That’s handy for undoing a bad edit, but it isn’t a separate backup. Versions can be turned off, trimmed or used up, and Microsoft says versions removed by a trimming job are permanently deleted and can’t be recovered unless a separate backup already exists.

How far back your account can reach depends on settings your admin controls, so ask your Microsoft 365 or Google Workspace admin what your company can still restore. A shared drive and a separate backup do different jobs, which is the whole point of cloud backup vs cloud storage.

A separate backup of the cloud account

The fourth kind copies your cloud account somewhere else. Microsoft sells one, Microsoft 365 Backup, a pay-as-you-go service billed by Microsoft that backs up selected SharePoint sites, OneDrive accounts and Exchange mailboxes. Google’s help pages don’t describe a Google-run equivalent for Workspace, so if your office runs on Google, ask your IT provider which service backs up the account.

03The decisions that shape your plan

Once your map is filled in, a handful of decisions shape the rest of the plan. Each one has its own guide.

How many copies. CISA’s rule of thumb is 3-2-1: three copies of important files, on two kinds of storage, with one kept off-site. The 3-2-1 backup rule shows how to count them, starting with the file you’re working in.

How the copies are made. Many backups copy only what changed since the last run. When a quote mentions incremental backup, that’s what it means, and you still need to ask what a restore requires. See incremental vs. differential backup.

Photos that stay on the phone. Pictures still on a crew phone need their own handoff into a company folder: how to back up job photos to the cloud.

How far back you can go. How far back you can still recover a version is backup retention, which isn’t the same as how long you keep business records. CISA suggests making sure you can roll back at least seven days. Beyond that there’s no official period for contractors to copy, so it’s a choice your business makes.

How often. NIST’s catalog of security controls (SP 800-53) says to back up at a frequency the organization sets, tied to how long it can be down and how much recent work it can afford to lose. In plain terms, you pick the cadence based on the estimating or invoicing you could stand to redo. CISA’s guidance for small businesses adds that scheduling backups isn’t enough on its own. More in how often to back up a work computer.

Whether a restore works. CISA also says to test partial and full restores regularly. A finished backup job doesn’t prove you can open the file, so agree on backup testing before you need a restore.

Whatever frequency and retention you settle on, make sure they’re written into the plan.

04Data backup questions to ask before you buy or switch

Whether you’re buying a backup for the first time or switching providers, the same few questions sort out what you’re actually getting. Write the answers on your worksheet as you go.

What’s included? Ask which computers, cloud accounts, shared drives and mailboxes are on the list. At Ghostworx, coverage is agreed during onboarding and written into your service plan. Essential Care and Managed IT both include backup of the business data the plan lists, with monitoring, backup checks and restore tests that are never billed on top. The security and backup page shows what’s usually covered.

What’s left out? Get the exclusions in writing. Our standard coverage doesn’t include:

• Files stored only on a computer
• Photos and files stored only on a phone, and full-phone backups
• Personal email and personal cloud accounts
• Microsoft Teams chat history
• Data inside job software such as JobTread, Buildertrend or Jobber
• Accounts and shared locations that aren’t on the onboarding list
• Servers and network storage (NAS)
• A complete image of a computer

Backup for files on computers can be set up as a separately scoped arrangement.

Who can ask for a restore? Name the people allowed to request one. Then ask whether a single file can come back without overwriting the version someone is working on today. That matters the morning after an invoice spreadsheet gets saved over.

Who owns the backup? Ask who owns it and which company holds it. If the plan doesn’t say, leave that line blank until it does.

What costs extra? Ask which restore work, backup beyond the plan, software subscriptions and major recovery are billed outside the monthly fee. With Ghostworx, restores you ask for are $200 an hour on Essential Care, approved by you first, and included on Managed IT for covered backups. Major recovery and extensive rebuilding are quoted separately. Both plans are on the pricing page.

How often, and for how long? Your quote should state how often backups run and how long versions are kept. Copy both onto your worksheet.

When every row has a named owner and a written answer, you’re ready to compare quotes on what they actually cover.