The 3-2-1 backup rule is a simple standard for protecting business data: keep three copies of anything important, hold them on two different types of media or locations, and keep one of those copies off-site. Every other security control is about keeping trouble out. Backups are what carry you through when something gets in anyway.
Ransomware, a failed hard drive, a deleted folder, a flood in the server closet — backups are the difference between a bad afternoon and a business-ending week. The frustrating part is that most businesses believe they have backups right up until the day they need one. Here is how to actually be covered.
What does the 3-2-1 rule mean in practice?
The three numbers describe how many copies you hold, how many places they live in, and how far away the safest one sits.
- Three copies means the working original plus two independent backups, so losing any one of them never leaves you down to a single point of failure.
- Two types of media or locations means the copies do not share a fate. One failed device, one power surge, or one bad afternoon in the office should never be able to reach all of them at once.
- One copy off-site means at least one backup lives somewhere physically separate or in the cloud, out of reach of fire, theft, and anything else that affects the building.
Why do backups fail on the day you need them?
Because almost nobody tests them. A backup you have never restored from is an assumption, not a safety net, and the assumption tends to hold right up until the moment it matters.
Backups fail quietly. A job gets misconfigured and skips a folder. A drive fills up and new copies stop writing. Files copy successfully but land corrupted. A new shared folder is created and never added to the schedule. None of that announces itself, and a green status light only tells you the software finished — not that the data inside is usable.
The fix is a restore test on the calendar, at least quarterly. Pick a handful of real files, bring them back to a safe location, and confirm they actually open. Once a year, walk through a larger recovery and time it, so you know roughly how long you would be down. Write down what you learn.
How do you keep ransomware away from your backups?
By making sure at least one copy cannot be reached, changed, or deleted from the machines you use every day. Modern ransomware looks for backups deliberately, so a copy that is simply connected is a copy that is exposed.
A backup sitting on a drive plugged into the same computer is not really a backup. Ransomware and power surges take both at once.
Three arrangements do most of the work. Keep an immutable or offline copy that cannot be altered once it has been written. Give the backup system its own credentials, separate from everyday administrator accounts, so a single compromised login cannot wipe your recovery options. And keep versioning switched on, so you hold several points in time rather than one copy that quietly overwrites itself with the damaged version. Between them, those three steps mean an incident on your working systems does not automatically become an incident on your recovery plan.
How much backup history should you keep?
Long enough to reach back past a problem you did not notice straight away. Ransomware often sits quietly for weeks before it acts, and a deleted file or a bad data entry can go unnoticed for just as long. If you only hold last night's copy, last night's copy may already contain the problem.
Several weeks of versioned history is a sensible target for most small businesses, with monthly checkpoints kept for longer where storage allows. The practical test is straightforward: how long could something realistically go wrong here before somebody noticed? Your retention needs to comfortably exceed that number.
Balance it against cost and obligations. Some records you are required to keep for years, while working files may only need a few months. Decide deliberately rather than accepting whatever the default setting happens to be.
What should you back up first?
Start with the data that would stop you trading, then work outward. Most businesses do not need everything protected to the same standard — they need the important things protected properly.
| What to back up | Why it comes first | Sensible minimum |
|---|---|---|
| Financial and accounting records | Losing them stops invoicing, payroll, and tax filing at once | Daily copy, off-site, with several weeks of versions |
| Customer records and contracts | Hard to reconstruct, and the loss becomes your customers' problem too | Daily copy, off-site, plus one copy that cannot be altered |
| Email and shared documents | Cloud providers sync deletions faithfully, including the accidental ones | Independent backup separate from the provider's own recycle bin |
| Systems and configurations | Rebuilding settings by hand is what turns days into weeks | Documented setup plus a full image where practical |
| Everything else | Lower stakes individually, and rarely worth premium storage | Weekly copy, shorter retention, tested less often |
The bottom line
Follow 3-2-1, keep at least one copy ransomware cannot touch, and above all confirm that you can restore. Do that, and a worst-case day becomes a recovery you control rather than a decision forced on you.