Backups for Business: The 3-2-1 Rule Explained
For a business, losing data isn't an inconvenience — it can be existential. Hardware fails, devices get stolen, files get deleted by accident, and ransomware can encrypt everything in minutes. The proven defence is refreshingly simple, and it has a name: the 3-2-1 rule.
The 3-2-1 rule
- 3 copies of your data (the live version plus two backups).
- 2 different media — for example an on-site device and the cloud, so one type of failure can't take out both.
- 1 copy off-site, kept away from your premises (cloud counts), so a fire, flood or theft can't destroy every copy at once.
Many now extend it to 3-2-1-1-0: one of those copies kept offline or immutable (so ransomware can't reach it), and zero errors when you test a restore. The principle is the same — don't let any single event wipe out everything.
Why each part matters
A single backup on a drive sitting next to the server fails the test — a break-in, fire or power surge could take both at once. Cloud-only fails differently: an accidental deletion or a ransomware infection can quietly sync to the cloud copy too. It's having multiple copies, in multiple places, on different media, that lets them cover each other's weaknesses.
The part most businesses skip: testing
A backup you've never restored from is just a hope. The single most important habit is to test restores regularly — actually bringing data back to confirm it's complete, uncorrupted, and recoverable within a timeframe your business can live with. Far too many businesses discover their "backup" was silently failing only at the worst possible moment.
How much, and how often?
Match your backup frequency to how much data you could afford to re-create. If losing a day's work would hurt, daily isn't enough — you'll want something closer to continuous. Keep a history of versions too, not just the latest copy, so you can roll back to before a problem (or a ransomware infection) occurred rather than backing up the damage. This ties directly into your wider disaster recovery plan.
Don't forget cloud services
Email and documents in services like Microsoft 365 or Google Workspace are your responsibility to back up. The provider keeps the service running and guards against their own outages, but they won't restore data you (or an attacker) delete once their short retention window passes. Dedicated third-party backup covers that surprisingly common gap.
Let us put it on autopilot
Our managed IT services include monitored, tested backups so you're protected without having to think about it, and our cyber security service hardens you against ransomware in the first place.