🎯 The business: you set up backups for small offices that cannot afford to lose files, such as accountants, law firms and clinics, and then prove every month that the backups actually restore. You install the backup software, keep one copy offsite where ransomware cannot delete it, run restore tests, and write the one-page plan the office follows on a bad day. You charge for the setup and a monthly fee per computer.
At a glance
| Money to start | ≈ $283 to $2,633 |
| Time to the first paid client | 3 to 8 weeks |
| Hours a week | 6 to 12 part time; 20 or more with a dozen clients |
| Skills that matter most | Backup software, Windows and Mac basics, Microsoft 365 or Google Workspace, patience with testing, clear written plans |
| What it can pay | About $2,600 a month before tax with 120 computers under a plan and one setup a month (worked below) |
Is this for you?
It suits a careful, methodical person who gets satisfaction from a checklist done right. Most of the work is quiet: checking reports, fixing failed jobs, restoring test files. The rare emergency is when it all pays off.
It is a poor fit if you find routine boring. A backup service is only worth paying for if someone checks it every week, without fail, for years. It is also a poor fit if you cannot stay calm on the phone with an owner whose files have just been locked by ransomware.
Who pays, and what
Offices whose files are the business: accountants and tax preparers, law firms, clinics and therapists, engineers and architects, insurance and real estate offices. Many think Microsoft 365, Google Drive or Dropbox is their backup. Those services keep files available and keep deleted items for a while, but a deleted account, a long-unnoticed mistake or ransomware syncing encrypted files can still cost them data. Microsoft itself sells a separate Microsoft 365 Backup product, priced at $0.15 per GB of protected content a month.
The reason to pay is ransomware and simple accidents. The FBI’s 2025 Internet Crime Report received more than 3,600 ransomware complaints with losses over $32 million, and the FBI notes that figure usually leaves out lost business, time and files, which are the real cost for a small office. CISA’s ransomware guidance tells organizations to keep offline, encrypted backups and test them regularly, because many ransomware strains look for backups and delete them first.
Some clients are required to have a plan. The HIPAA Security Rule requires a data backup plan, a disaster recovery plan and an emergency mode operation plan; testing them is "addressable", meaning the practice must do it or document why not. Cyber insurers commonly ask about backups on applications. In this field, AI is mostly neutral: it does not replace a tested backup, and AI-written phishing is one more way ransomware gets in.
What they pay, from research estimates: setup of about $500 to $2,000 per office, plus about $10 to $30 per computer a month. Backup is often sold inside managed IT plans, so your edge is focus: tested restores and a written plan, for offices that don’t want a full IT contract.
What it takes to start
| LLC or sole proprietorship and local license | $150 to $500 |
| Backup software partner or reseller account (many start free) | $0 to $300 |
| Practice backup device and drives (optional) | $0 to $600 |
| Cloud storage for your own tests, 1 TB for a year (Backblaze B2 lists $6.95 per TB a month) | About $83 |
| Errors and omissions plus cyber liability insurance (an estimate; get quotes) | $0 to $1,000 first payment |
| Domain, simple website, business email | $50 to $150 |
| All-in | ≈ $283 to $2,633 |
Clients pay for their own backup licenses and storage through you or directly. Keep their backups in accounts the client owns or can take over, so they are never stuck if you stop working together.
Start to finish: the steps
1. Learn two kinds of backup. Computer and server backup (whole machines and file shares) and cloud app backup (Microsoft 365 or Google Workspace mail and files). Most backup vendors run free partner training. Practice full restores on an old laptop until you can do it from memory.
2. Choose your tools. Pick one backup product with a partner program and multi-client console, and one storage provider that offers immutable (locked) storage for a set number of days. Check every vendor’s current price and terms; they change.
3. Make the business legal. Register, get the local license, and buy errors and omissions plus cyber liability insurance. A failed restore can cost a client a lot, so your contract must say what you check, how often, and what you are not responsible for. See Business insurance.
4. Offer a paid backup check. Visit, list what is and isn’t backed up, and try one restore in front of the owner. Many offices discover a gap on the spot. Hand back a one-page result and a quote.
5. Set it up properly. Back up every computer that holds client files, the server or shared drive, and the cloud mailboxes and files. Send one copy offsite to locked storage. Turn on multifactor sign-in for the backup console; attackers who get into it can delete everything.
6. Write the recovery plan. One page: who to call, which systems come back first, where the copies are, how long a full restore takes (measured, not guessed), and how to work by hand meanwhile. For clinics, this feeds their HIPAA contingency plan.
7. Test, then prove it. Restore a real file every month and a whole computer every quarter. Send the owner a short note each time: what you restored, how long it took, whether it opened.
8. Sell the monthly plan. Monitoring, fixing failed jobs, monthly and quarterly tests, plan updates and a yearly drill with the owner. Price per computer, with cloud mailbox backup per user.
9. Partner for the rest. Offices will ask for help with everything else. Refer full IT support to a managed IT provider and keep the backup work, or join one as their backup specialist.
Pricing
| Backup check with a test restore, credited to setup | $300 to $600 |
| Setup for one office | $500 to $2,000 |
| Monthly plan per computer, with tests and reports | $10 to $30 |
| Microsoft 365 or Google Workspace backup, per user | $3 to $6 a month (example) |
| Emergency restore work outside the plan | $100 to $175 an hour (example) |
Setup and per-computer prices are research estimates; the per-user and hourly rates are examples. Charge servers more than laptops. Never promise "zero data loss" or a recovery time you have not measured; promise the schedule of backups and tests, and report what each test showed. More in Pricing AI and IT services.
The math
Take a specialist about a year in. Twelve offices averaging 10 computers is 120 computers at $20 a month: $2,400. One setup a month at $1,200 brings the total to $3,600. Costs: backup software wholesale at about $6 a computer, $720 (an example); 6 TB of locked cloud storage at $6.95, about $42; insurance $100; marketing $100; other tools $38. That is $1,000, leaving about $2,600 a month before tax for roughly 20 hours a week.
Expect a slow first quarter while you find two or three clients. Set aside about a quarter to a third of profit for tax. See Small business taxes.
Getting customers
Who to approach first. Accountants, lawyers and clinic owners you already know, starting with your own. Then people who hear about lost files first: bookkeepers, insurance agents who sell cyber policies, computer repair shops, and managed IT providers that would rather hand backup testing to a specialist.
The first ten customers. List 50 offices of 3 to 25 people that live on their files. Send 30 short emails, make 10 follow-up calls, and give two 20-minute talks (chamber, local bar or CPA chapter) called "Could you restore your files by Monday?" As an example over about three months: 5 to 7 conversations, 3 paid backup checks, and 2 offices on a monthly plan. Tax preparers are busiest before April, so reach them in summer and fall.
Hi Tom, I set up and test backups for small accounting and law offices around Westfield. Many offices I visit think their cloud storage is a backup, then find out a deleted folder or a ransomware attack can still take files with it. I offer a one-hour backup check for $350: I list what is protected and what isn’t, and I restore one real file in front of you so you can see it work. If the check turns up nothing to fix, you get that in writing too. Would a visit this month be useful?
Channels, best to worst for this customer.
1. Referral partners (bookkeepers, insurance agents, repair shops, IT providers): they meet the problem first and trust carries over.
2. Trade associations (county bar, state CPA society, local medical or dental society): a short talk reaches the offices that need this most.
3. Chamber of commerce and referral groups: steady local introductions.
4. Google Business Profile with reviews: people search for "data recovery" or "backup service" after a scare.
5. LinkedIn: short posts on one restore lesson at a time, aimed at local professionals.
6. Marketplaces such as Upwork: few local offices hire backup this way; skip at first.
7. Paid ads: last. "Data recovery" clicks are expensive and bring one-time emergencies.
Case studies and referrals. Keep each client’s restore test log. With permission, share a short story such as "12-computer firm: monthly file restores, quarterly full-PC restores, average full restore 2 hours", using that client’s measured numbers. When you recover a deleted folder for a client, that is the moment to ask for one introduction. More in Launch and marketing playbook.
Running it week to week
Every working day: read the backup console for failed or missed jobs and fix them before the next run. Weekly: check that the offsite copy is up to date and that storage is not filling up. Monthly: restore a real file for each client and send the note. Quarterly: restore a whole computer to spare hardware or a virtual machine, and update the recovery plan. Yearly: run a tabletop drill with each owner. Keep your own console locked down with multifactor sign-in.
Rules to check
No license is needed to set up backups. The rules come from your clients’ data. Health practices make you a HIPAA business associate if you can reach their patient data: sign a business associate agreement, and use backup and storage vendors that will sign one too. Tax preparers and many accounting firms fall under the FTC Safeguards Rule, which requires encryption of customer information, multifactor sign-in for anyone accessing their systems, and notice to the FTC within 30 days of a breach involving 500 or more people; the IRS’s Publication 4557 explains safeguards for tax professionals. Lawyers have a professional duty under their state bar rules to protect client information. Every state has a data breach notification law, and a lost or stolen backup drive can trigger it, so encrypt every backup. Clients may also have rules on how long records must be kept; ask them and their adviser, and set retention to match. You do not decide what the law requires of a client; you configure what they ask for and document it. See Contracts, client data and AI rules.
What goes wrong
A backup reports "success" but the files will not open; only real restore tests catch that. Ransomware reaches the backup console because it shared the office password; use separate accounts and multifactor sign-in. The offsite copy fills up and quietly stops; watch storage weekly. A new laptop joins the office and nobody tells you; ask every month. A client stops paying, then calls during a crisis; set an emergency rate in writing. And a restore takes two days when the owner expected two hours; measure restore times and put them in the plan.
Questions people ask
How much does a backup service cost for a small business?
As research estimates, setup runs about $500 to $2,000 per office, plus about $10 to $30 per computer a month. Cloud mailbox backup is often a few dollars per user a month on top.
Is Microsoft 365 or Google Drive a backup?
Not on its own. They keep deleted items for a limited time, but a deleted account, a mistake noticed too late or ransomware that syncs can still lose data. Microsoft sells a separate Microsoft 365 Backup product, and many third-party tools back up both platforms.
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different kinds of storage, with one copy offsite. For ransomware, make the offsite copy locked so it cannot be changed or deleted for a set period, and test restores regularly.
How often should a small office test its backups?
CISA advises testing backups regularly. A practical schedule is a file restore every month and a whole-computer restore every quarter, with the results written down.
Can a college student do this part time?
Yes for setup and remote monitoring, if someone can answer an emergency during business hours; partnering with a local IT provider covers that. International students on F-1 visas generally cannot freelance for outside clients without work authorization; ask your international student office first. More in For students.
Free help
CISA’s #StopRansomware guide and its Cyber Guidance for Small Businesses explain backup and recovery steps in plain terms, and CISA’s free Cyber Hygiene scanning checks a client’s internet-facing systems. HHS publishes HIPAA Security Rule guidance for health practices, and the IRS publishes Publication 4557 for tax professionals. SCORE mentors and Small Business Development Centers help with pricing and contracts at no cost.
Checked in November 2026: FBI 2025 ransomware figures, CISA backup guidance, HIPAA contingency plan and FTC Safeguards Rule text, Microsoft 365 Backup and Backblaze B2 list prices. Backup tool prices change often, and the setup and per-computer fees are research estimates; check vendors’ current prices before you quote.