Backup For
Machine Shops & Small Manufacturers

The files a machine shop cannot afford to lose

Shop-floor production depends on files that represent hours of programming, setup, and process-development work. Many of those files exist in only one place: a PC on the shop floor, a shared drive that everyone can reach, or a folder on the owner's laptop. The following categories are what a working machine shop should be able to recover, from a specific date, on demand.

• CNC part programs and toolpaths (G-code), including finished production programs, in-progress programs, and archived revisions for repeat jobs
• Post-processor configurations tied to specific machines, which often require significant setup effort and are not easily recreated from scratch
• Your CAD/CAM package's project files, libraries of tooling data, material presets, and saved machining strategies
• DNC (direct numerical control) file trees and the configuration files for any software that transfers programs to and from CNC controls
• Setup sheets and work instruction documents for each job and each machine, including tooling lists, fixture references, and workholding notes
• Job travelers and routing documents that track a part through each operation from raw material to finished shipment
• QC and inspection records, including first-article inspection reports, in-process measurement logs, and shipping inspection records
• Customer-supplied drawings, models, and revision-controlled part specifications that govern what you are producing
• Bills of materials and material certifications for jobs with traceability requirements
• Supplier and vendor records, open purchase orders, and receiving documentation
• Your ERP or job-tracking system's data files, exported reports, and configuration backups if the system stores data locally
• QuickBooks or other accounting files, including job cost records, invoicing history, and payroll records
• Email archives (PST files or locally stored mail) containing customer correspondence, order confirmations, and engineering change notices

Any one of these categories can become the critical file when a customer calls about a revision, when a machine needs a program after control hardware fails, or when a dispute arises over what was approved to run. A backup that cannot produce a specific file from a specific date does not protect a production shop.

Why shop-floor files are in their own risk category

CNC programs are not documents in the traditional sense. They are executable production instructions. A program with a wrong offset, a bad tool-change line, or an incorrect feed rate can scrap a part or damage a machine. Shops invest significant time verifying, proving out, and refining programs before they run in production. Losing a proven program and having to reprove it from scratch is not just an inconvenience, it is rework time billed to no one, on a machine that should be making parts.

The same applies to post-processor configurations. A post-processor that converts your CAD/CAM output into machine-ready G-code for a specific control is typically customized over time to match that machine's quirks, option set, and parameter layout. If that configuration is lost, you are not just reinstalling software, you are redoing months or years of tuning work, or paying someone to redo it.

Job travelers and QC records carry a different kind of value. When a customer calls with a question about a shipment from six months ago, or when a part that shipped last year comes back with a warranty question, the ability to pull that job's traveler, its inspection record, and the program revision that ran it determines whether you can respond with facts or guesses. Shops with good records recover from those calls quickly. Shops without them spend hours trying to reconstruct what happened.

This page covers the shop-floor and production side of a manufacturing operation. If your business also includes engineering design work, PE-stamped deliverables, or detailed design authorship, see backup for engineering firms for guidance on that side of the work.

Why the usual "backups" fall short for a shop

• Programs living on the CNC control or on one floor PC. Many shops have CNC programs stored on the control itself, or on a single Windows PC connected to the machine for DNC transfers. That PC is often old, rarely patched, and not included in any regular backup scope. When the hard drive fails or the PC is damaged, every program on it goes with it. Reproving those programs from scratch can mean days of machine time that should have been spent making parts.
• A shared network drive treated as a complete backup. Putting programs and job files on a shared network drive is a good organizational step. It is not a backup. A shared drive that everyone can write to also means everyone can accidentally delete from it, overwrite a proven program with a bad revision, or expose it to ransomware that travels through the network. A shared drive has no independent version history and no off-site copy. It is useful for access, not for recovery.
• A NAS or RAID array mistaken for backup. NAS and RAID protect against a single drive failure, and that is a genuine benefit. They do not protect against deletion, against a bad program overwriting a good one, against ransomware encrypting everything on the network, against a theft, or against a fire. For a full discussion of why NAS and RAID do not substitute for backup, see NAS is not a backup.
• USB sticks walking the shop floor. USB drives used to move programs to machines are a common workflow and also a common source of lost and overwritten files. A thumb drive full of programs gets left on a machine, falls behind a cabinet, or gets cleared by someone who needed the space. There is no version history, no off-site copy, and no monitoring. A program that existed on a USB last week may be gone with no record of what it contained.
• A cloud sync folder that propagates every change immediately. Syncing a folder of CNC programs to a cloud storage service means a bad save, a wrong overwrite, or a deleted program syncs to the cloud within seconds, replacing the good copy. If a ransomware event encrypts the local files, the encrypted versions sync and overwrite the clean cloud copies before most shops notice anything is wrong. Sync is not backup. A backup with independent version history and retention depth is what allows recovery from those events.
• QuickBooks and accounting files on one machine with no off-site copy. Intuit's own guidance recommends regular, off-site backup of QuickBooks company files. A QuickBooks file on a single machine, backed up only to the same local drive or to a mapped network share, is one hardware failure or one ransomware event away from being gone. For a deeper look at QuickBooks-specific backup gaps, see QuickBooks backup for small businesses.
• No tested restore process. CISA, through its #StopRansomware campaign, explicitly recommends periodic testing of backups to confirm that the data is actually recoverable, not just that backup jobs are completing. A backup job that runs nightly but has never produced a successful file restore is a backup of unknown reliability. Testing is not a one-time event, it is an ongoing operational practice.

What a real backup plan looks like for a machine shop

CISA's 3-2-1 guidance calls for three copies of important data, stored on two different types of media, with one copy stored off-site. Applied to a machine shop, that principle maps to concrete steps. The questions below help you assess where your current setup stands.

• Are your CNC programs and post-processor configs in a backed-up location? Programs that live only on a control PC, a USB drive, or a network share that is not independently backed up are not covered. The first step is confirming that every production program and its associated configuration files are saved somewhere that is in scope for your backup, not just somewhere that is convenient for the floor.
• Is there an off-site copy, independent from your shop network? Per CISA's 3-2-1 principle, at least one copy of your backup data should be off-site. If every copy of your programs and files lives in the same building, a fire, a flood, or a theft removes all of them at once. Off-site encrypted backup means a copy exists somewhere that a physical event at your shop cannot reach.
• Does your backup retain enough version history to recover a prior revision of a program? Programs get modified, updated, and occasionally broken. A backup that keeps only the most recent version cannot restore a program as it was two days ago, before someone changed the canned cycle on op two. Meaningful retention depth, enough to go back days or weeks, is what separates a recovery-grade backup from a simple current-copy storage.
• Does your backup window cover delayed-discovery events? Ransomware is often not noticed for days or weeks after the initial infection. A backup retention window of only 24 to 48 hours may not allow recovery of clean files from before the event. CISA recommends backup retention sufficient to cover delayed-detection scenarios. A shop that discovers encrypted files on a Tuesday needs to be able to restore from the previous Friday's backup, not just from yesterday's.
• Is backup data encrypted in transit and at rest? Job files, customer-supplied drawings, BOM data, and pricing information are confidential. Backup data should be encrypted before it leaves your shop and remain encrypted in storage. Everyday Backups encrypts data in transit and at rest.
• Do you receive an alert if a backup job fails? A backup that runs silently and fails silently leaves you with no coverage and no warning. Monitoring that flags a missed or failed backup is a baseline requirement. Everyday Backups includes monitoring and alerts as part of the service.
• Has anyone actually tested a restore? Completing a restore test, pulling a specific program file from a specific backup date and confirming it opens and contains the correct content, is the only way to know a backup is working. A quarterly spot-restore of a CNC program, a job traveler, and a QuickBooks backup file takes under an hour and confirms your coverage is real.
• Does someone other than the person who set it up know how to run a restore? If the only person who knows how to recover files from your backup is unavailable when something goes wrong, the recovery takes longer or does not happen at all. A documented restore process and at least two people who know how to follow it are a practical safeguard.

For a broader assessment starting point, work through the small-business backup checklist. For context on ransomware-specific recovery planning, see ransomware restore readiness.