The Illusion of Safety
Somewhere on your network, a backup program is probably running. Maybe it’s a Windows Backup schedule set up when someone first built the server. Maybe it’s a cloud backup service your previous IT person installed three years ago. Maybe it’s an external hard drive that someone plugs in when they remember to. The backup light is green. The last backup completed. There’s a sense that the data is protected. And most days, that sense of security is never challenged — which means most accounting firm owners never have to find out whether it’s warranted.
Until the day they do. The day a ransomware attack encrypts every file on the server, or a flood takes out the local hardware, or a failed hard drive corrupts a decade of client records — that’s the worst possible moment to discover that the backup was misconfigured or that the restore process doesn’t actually work. The industry has a saying that cuts right to the heart of this: untested backups are not backups. They are the hope of a backup. And hope is not a disaster recovery strategy.
What Accounting Firms Stand to Lose
When people think about data loss, they tend to think about the inconvenience of restoring files. The reality for an accounting firm is significantly more serious. Client tax returns going back years. Business financial records. Engagement letters and signed documents. QuickBooks data files representing years of bookkeeping. Email archives documenting client communications and decisions. Some of this data has legal retention requirements. Some of it is the basis for current and future client work that cannot simply be reconstructed. Losing it isn’t just an operational setback — it’s a breach of professional responsibility and potentially a regulatory violation.
Ransomware attacks are increasingly targeting small professional services firms. The ransom demand for a small business is typically between $10,000 and $100,000. Payment does not guarantee recovery — criminals frequently take the payment and provide decryption tools that don’t fully work. The FBI and CISA both recommend against paying ransoms. The only real defense against ransomware is a clean, tested, ransomware-resistant backup that allows you to restore your systems without negotiating with criminals.
The 3-2-1-1-0 Backup Standard
The foundational principle of data backup is the 3-2-1 rule: maintain three copies of your data, on two different types of storage media, with one copy stored offsite. Modern ransomware attacks have led to an updated version: 3-2-1-1-0. The extra ‘1’ means keeping one copy that is immutable — meaning it cannot be modified or deleted, even by someone with administrative access. The ‘0’ means verifying that restores complete with zero errors. Immutable backups exist specifically because sophisticated ransomware increasingly attempts to encrypt or delete backup files along with primary data.
I’ve had the uncomfortable conversation with more than one firm owner who discovered, during an actual recovery scenario, that their backup had been failing silently for months. The software was installed. The schedule was set. But a configuration error meant no actual backup was being written. Automated backup health monitoring prevents this — but only if someone sets it up and watches it.
— Graham Pearson, MBA · Ma3SP Technology · Goshen, IndianaRecovery Time Objective: How Long Can Your Firm Actually Afford to Be Down?
A recovery time objective (RTO) is the maximum amount of time your business can afford to be without its systems before the impact becomes critical. For most accounting firms, especially during tax season, that number is very small — hours, not days. Here’s the question worth asking right now: if you had a complete system failure tonight, how long would it actually take to get back up and running, based on what your backup and recovery setup currently looks like? Without a tested, documented recovery plan, that question has no reliable answer — and an unknown RTO is the same as no RTO.
Indiana Data Breach Law and What It Requires of You
Indiana’s data breach notification statute (IC 24-4.9) requires businesses to notify Indiana residents when a breach occurs that compromises unencrypted personal information. Combined with FTC Safeguards Rule requirements for accounting and tax preparation firms, the legal framework around data protection is clear and consequential. A breach that occurs because you didn’t have adequate backup and recovery controls triggers notification requirements, potential regulatory scrutiny, and reputational damage that can take years to repair. Ma3SP works with accounting firms to build a backup architecture that meets the 3-2-1-1-0 standard, then tests it — actually tests it, with a real restore, documented and verified — so the recovery plan isn’t a hope but a confirmed capability.