Your mission matters.
So do your files.

The files a school or nonprofit can't afford to lose

Think for a moment about what lives on that one office laptop, or scattered across a handful of Google Drive folders. These are the records your organization depends on — and many of them can't be recreated if they disappear.

• Student enrollment records, rosters, and registration paperwork
• Gradebooks and academic records
• Tuition invoices, payment histories, and financial aid records
• Donation records, giving statements, and pledge histories
• Donor and member databases
• Financial statements, budgets, and bookkeeping files (often QuickBooks or a spreadsheet someone built years ago)
• Board meeting minutes, bylaws, and founding documents
• Grant applications, funder reports, and award letters
• Payroll records and employee or contractor files
• Volunteer records and background-check documentation
• Event photos, ministry media, and newsletter archives
• Sermon recordings and lesson archives

Some of these files took years to build. A lost gradebook means phone calls to every family. A missing donor database means starting over before your next appeal. A corrupted QuickBooks file means your bookkeeper spending weeks reconstructing transactions. A solid backup means none of those scenarios have to happen.

Where backup gaps hide

• The one office laptop that is effectively the server. Many small schools and nonprofits run their entire operation off a single Windows laptop or an aging desktop in the office. If that machine fails — hard drive crash, theft, spilled coffee — everything on it is gone unless it was backed up somewhere separate.
• Mistaking Google Drive or OneDrive sync for backup. Sync is not backup. When you delete a file or a ransomware attack encrypts your files, sync faithfully copies those changes to the cloud too. Version history exists, but it has limits — Microsoft's OneDrive version history is not unlimited and does not replace a true backup with independent storage. (More on this in the next FAQ.)
• Files spread across volunteer personal devices and personal accounts. The volunteer who handles social media keeps photos on her personal iPhone. The newsletter editor has three years of designs on his home laptop. The treasurer uses his personal Google account for budget drafts. When volunteers move on, those files can leave with them — or just become unreachable.
• Treating your church or school management system as your only copy. Church management systems (ChMS) and student information systems (SIS) store your data in their database — but your local exports, reports, and downloaded files are not automatically backed up anywhere. If you export a giving report to a spreadsheet and save it to your desktop, that export is only as safe as your desktop.
• Turnover without a handoff plan. A staff member or long-tenured volunteer leaves. Their laptop gets wiped. The files they kept locally — or saved to a personal account "for convenience" — walk out the door. Routine backup with an offsite copy means the organization's data stays with the organization.
• No one has ever tested a restore. A backup you have never tested is a backup you cannot trust. Many small organizations set up a backup once and never open it again. Quarterly restore tests — even just recovering one file — confirm the backup is actually working.

Sync tools are genuinely useful, but they are not a substitute for a separate backup copy. For a plain-English breakdown of the difference, see our guide on cloud sync vs backup.

A gentle backup standard for lean organizations

You don't need a full IT department to protect your files. CISA (the U.S. Cybersecurity and Infrastructure Security Agency) recommends a simple framework called the 3-2-1 rule for organizations of every size: keep 3 copies of your data, on 2 different types of media, with 1 copy offsite or offline. Here's what that looks like in practice for a school or nonprofit:

• Keep at least one copy completely separate from your main device. The copy on your office laptop counts as one. A backup stored in a separate cloud service — not just sync — counts as a second. An external drive kept offsite (at someone's home, for example) can be your third.
• Use version history, not just the latest copy. Ransomware and accidental deletions can corrupt or wipe your current files. A backup with version history lets you step back to a point before the damage happened. Make sure your backup solution retains multiple versions, not just the most recent.
• Make sure data is encrypted in transit and at rest. Your financial records, student records, and donor data deserve the same basic protection any business would provide. Encryption means that even if backup files were somehow accessed by the wrong person, they couldn't be read.
• Set up monitoring and failure alerts. Backups can quietly stop working — a changed password, a full drive, a network hiccup. You want to know right away if a backup job fails, not months later when you actually need it.
• Name one person as the backup owner, even if they're a volunteer. It doesn't have to be complicated. It just has to be someone's job. That person sets up the backup, watches for alerts, and does a quick restore test once a quarter.
• Test a restore at least quarterly. Pick one file. Restore it. Confirm it opens. That ten-minute exercise gives you real confidence — and it surfaces problems before a crisis does.

For a printable version of these steps you can share with your office manager or board, see our small-business backup checklist. If you've heard about ransomware attacks hitting schools and nonprofits and want to understand your exposure, our ransomware restore readiness guide walks through what to look for.