One dead laptop, one ransomware pop-up, one fired employee who "forgot" to hand over passwords — and your business is blind. The 3-2-1 backup plan, the password-vault habit, and a one-page continuity plan for the day you can't work.
Part of the Leveraged Owner 8-system framework
The office computer won't turn on. Ten years of customer records, every invoice, the employee files, the photos — on one hard drive that's now making a clicking sound. The owner is standing there doing the math on what a week without data costs, and it's the worst math of his life. Meanwhile every system in the 8-system framework assumes your data survives the day — and most shops have never once tested whether it would.
Before you can back anything up, list what matters. For a contractor shop, the irreplaceable stuff is:
The industry standard, simplified for a 1–20 person shop: 3 copies of important data, on 2 different types of media, with 1 copy offsite.
Copy 1: the live data — your computer, your cloud CRM, your accounting software. This is what you work in.
Copy 2: an automated cloud backup. For most shops this is a $6–$12/month service backing up the office computer to the cloud nightly, plus confirming your CRM and accounting tools have their own export or backup feature enabled. Set it once, verify monthly.
Copy 3 (offsite): a quarterly export on an encrypted USB drive stored somewhere that isn't your office — your house, a safe deposit box. Cloud fails too. The drive is your "the internet is down and the cloud is down" parachute.
The part everyone skips: test the restore once a year. Backups you can't restore are just expensive hope. Pick one file, restore it, confirm it opens. Ten minutes, once a year.
This is the single highest-ROI continuity move in this post, and it takes one afternoon. Get a password manager with a business plan. Move every shared business login into a shared vault. Then:
Every employee departure becomes a 5-minute access revocation instead of a 3-day password panic. Read the office-manager-quit playbook for the full departure checklist — passwords are chapter one.
"If I got hit by a bus" is the question owners avoid. Write the one-pager anyway — not because it's morbid, but because the day you can't work is exactly the day nobody can ask you questions.
[Business Name] — Continuity One-Pager
If I can't run the business, this person steps in: [Name, phone]. They have: [what access/authority].
Money: Operating account at [bank]. Payroll runs [day]; processor is [payroll company], login in password vault. Open invoices: [where to find aging report].
Jobs in progress: [FSM name] dispatch board has every active job. Current week's schedule: [where it's posted]. Key customers expecting callbacks: [where the list lives].
Credentials: Password vault master in [location of sealed envelope]. Two-factor recovery codes: [location].
Insurance, licenses, bonds: Agent [name, phone], policy numbers in [location]. License renewals due: [dates].
Key vendors: [top 3: supplier, software, insurance] with account numbers in [location].
Review date: [annual date]. Updated by: ______
Review it once a year — put it on the calendar next to your license renewals. A stale continuity plan is almost as bad as none, because it points people to the wrong person.
Contractor shops get targeted because they pay fast and have thin IT. The defense is boring and works: automatic updates on every computer, one admin account (not everyone's), email attachment skepticism training in 10 minutes at a huddle, and — the thing that makes ransomware survivable — the backups above. Ransomware on a machine with a tested cloud backup is an annoying afternoon. Without one, it's a negotiation with criminals.
No customer payment data on the office computer beyond what's in your processor's vault. No exceptions. Your processor (Stripe, your card terminal provider, whoever) is built for this; your Windows desktop from 2019 is not.
The office computer isn't the only device holding business data anymore. Your techs' phones have job photos, customer text threads, and gate codes. The office iPad has signed work orders. Devices get dropped in crawl spaces, left on truck hoods, and stolen from cabs.
The fix is two habits, not a big project. First: every business device gets cloud backup turned on — iCloud for iPhones, Google backup for Androids — tied to a business account, not the tech's personal Apple ID. When a phone dies, the photos and messages come back with the restore. Second: job photos go to the shared job folder the same day, not "when I get around to it." The photos on one tech's phone are the evidence in your next payment dispute; treat them like the business asset they are.
If a tech leaves, their device gets wiped and returned, or the business account access gets revoked — your call, but it happens on their last day, not "sometime next week." Moving systems? Switch CRMs without losing your customer data using the same protect-the-data mindset.
Monday: list your five data categories and where each lives. Tuesday: turn on automated cloud backup for the office computer. Wednesday: export your CRM customer list and your accounting data — save the exports somewhere off the live system. Thursday: password manager, shared vault, every business login moved in. Friday: write the continuity one-pager. While you're touching the database, give it the quarterly cleanup — backups of dirty data are still dirty.
Backup protects your data; the 8-system framework gives you systems worth protecting. Pair this with the quarterly CRM cleanup so what you're backing up is clean, and the office-manager-quit playbook for the people side of continuity.
The full setup SOP, all four copy-paste scripts (including the owner notification), the "Your Numbers" missed-call worksheet, and the step-by-step setup guide — free, no catch. Fix your missed calls this week.
Free. The full 8-system Starter Pack is $27 if you want everything else.
This post is part of the Leveraged Owner 8-system framework — the done-for-you Starter Pack with the full step-by-step SOPs, every script, the worksheets, and screen-by-screen setup instructions for all 8 systems.
Stats sourced as labeled: no third-party statistics used in this post.
Related guides from the Leveraged Owner blog:
AI estimating tools for contractors reviewed honestly: what they do, where they go wrong, and what to check before trusting a number.
Using AI to draft review responses: the workflow, how to edit the output, and how to keep your responses human.
The 8am–9pm texting rule for contractors: what TCPA quiet hours mean, what counts as consent, state variations, and scheduling campaigns that stay compliant.