The 3-2-1 Backup Rule for Small Businesses

Almost every business owner we talk to says the same thing: “We have backups.” Then a server dies or ransomware hits — and the backup turns out to be six months old, encrypted along with everything else, or a sync folder that faithfully copied the disaster to the cloud.

The fix is not exotic technology. It is a decades-old rule of thumb, applied with discipline. This post explains the 3-2-1 backup rule in plain English, why “we have backups” so often fails in practice, and how to get genuinely recoverable without an enterprise budget.

What the 3-2-1 rule actually says

The rule is simple enough to remember without writing down:

• 3 copies of your data. The original plus at least two backups. One backup is a single point of failure wearing a costume.
• 2 different types of storage. Not two folders on the same drive or two drives in the same server. Think a local backup appliance and a cloud backup service — different media, different failure modes.
• 1 copy offsite. Somewhere a fire, flood, theft, or network-wide ransomware event at your office cannot reach.

The logic: no single event should be able to destroy every copy at once. Every failed recovery story we have heard breaks at least one of the three numbers.

One modern addition worth adopting: keep at least one copy offline or immutable — impossible to alter or delete even with stolen admin credentials. Ransomware has made that part non-negotiable.

Why “we have backups” usually fails

The restore was never tested

A backup you have never restored from is a hope, not a plan. Backup jobs fail quietly: a drive fills up, a job errors out after an update, a folder gets excluded during a migration and nobody notices. The green checkmark says a job ran — not that the data is complete and restorable.

The only proof a backup works is a successful restore. If you have not done one recently, you do not know whether you have backups. You know you have backup software.

The backup lives on the network ransomware encrypts

Ransomware operators know where backups live; destroying them is standard playbook. A backup drive that is always plugged in, a NAS every workstation can browse to, a backup server on the same domain with the same admin credentials — all reachable by an attacker inside your network, and reachable means destroyable.

If your only backups sit on the network they protect, you have one copy for ransomware purposes, however many the console shows.

Sync is not backup

OneDrive, Dropbox, Google Drive, and similar sync services are not backup. They are excellent at what they do — keeping files identical across devices — and that is exactly the problem. Delete a file, and the deletion syncs. Ransomware encrypts your files, and the encrypted versions sync, overwriting the good copies in the cloud.

Sync services do keep version history and deleted-file recovery for a limited window. But retention windows are finite, restoring thousands of versioned files one by one is painful, and a compromised account can empty a shared library before anyone notices. Sync is a convenience layer. Backup is a separate, independent copy with its own schedule and retention. They are not interchangeable.

What “offsite” and “offline” mean now

Offsite used to mean tapes in a safe deposit box. Today a small business has better options:

• Cloud backup is the practical offsite copy for most businesses: an agent backs up servers, workstations, and Microsoft 365 or Google Workspace data to a provider’s storage on a schedule. The key phrase is backup service — a purpose-built tool with versioning and retention, not a sync folder.
• Immutable storage means backup copies that cannot be changed or deleted for a defined period — not by ransomware, stolen admin credentials, or an annoyed insider. Many cloud backup platforms offer this; if yours does, turn it on.
• Cold or offline copies are the modern tape-in-the-safe: an encrypted external drive rotated weekly and stored away from the office, physically disconnected the rest of the time. Low-tech, cheap, and immune to anything that travels over a wire.

A sensible setup: a local backup for fast restores, a cloud backup with immutability for the offsite copy, and a periodic cold copy of the truly critical data. That satisfies 3-2-1 and the offline requirement without heroics.

Test restores like you mean it

A restore test does not need to be elaborate — it needs to be real and scheduled:

• Monthly: restore a handful of files and one mailbox item to an alternate location. Confirm they open and are current. Fifteen minutes, calendar it, done.
• Quarterly: restore something substantial — a full folder tree, a database, or a virtual machine — and time it. That is your real recovery time, and it is usually longer than anyone assumed.
• After any change: new server, new backup software, migrated file share — test before you trust.

Log what you restored and how long it took. If a restore fails, that is the test working: you found the problem on a quiet Tuesday instead of during an outage.

What to back up first

Prioritize by what would hurt most to lose:

1. Financial data — accounting files, payroll records, invoices, tax documents. Losing these is an existential problem, not an IT problem.
2. Client records — contracts, project files, case files, anything you are obligated to retain or could not recreate.
3. Email — Microsoft 365 and Google Workspace protect their platforms, not your mistakes; third-party backup of cloud email is a real category for a reason.
4. Server configurations and line-of-business applications — the databases and settings that would take days to rebuild even if no client data were lost.

Workstations and shared drives follow. Cover those four categories with a tested 3-2-1 setup and you have eliminated most of the catastrophic outcomes.

A starter checklist

• List every place your important data actually lives — servers, cloud apps, workstations, that one laptop in accounting
• Confirm three copies of the critical data: original, local backup, offsite backup
• Confirm the two backups are on different media or platforms, not two folders on one device
• Make at least one copy offline or immutable, so ransomware and stolen credentials cannot touch it
• Enable backup for Microsoft 365 / Google Workspace email and files, separate from the platform itself
• Do one test restore this month and put a recurring restore test on the calendar
• Write down who checks backup job results — a name, not a department

If you can check every box, you are ahead of most small businesses. If several made you wince, that is useful information too.

When a managed provider makes sense

Backup only matters on the worst day of your business year, and by then it is too late to fix. If nobody on your team is checking job results daily, testing restores on a schedule, and adjusting coverage as systems change, then nobody is doing backup — a tool is running unsupervised.

A managed IT provider takes that responsibility off your plate: monitored backup jobs, scheduled restore tests, offsite and immutable copies configured properly, and someone accountable when a job fails at 2 a.m. That is a standing part of our managed IT services, and it costs far less than one serious data-loss incident.

Find out where you actually stand

The fastest way to know whether your backups would survive a bad day is to have someone check. Our free IT check-up includes a backup health review: what is covered, what is not, whether your offsite copy is really offsite, and when a restore was last proven to work. No obligation, and you keep the findings either way.

Prefer email? Reach us at operations@nextplus.org or through our contact page, and we will look at your setup before it gets tested for real.