The 3-2-1 backup rule explained (and why it still matters)

Hardware fails, people delete things by accident and ransomware encrypts whatever it can reach. The 3-2-1 backup rule is a simple way to make sure you can always recover.

Three copies of your data

Keep your live data plus at least two backups. If one backup is corrupted or out of date, you still have another.

Two different types of storage

Don't keep all copies on the same kind of device. For example, a NAS in the office plus cloud storage. A single fault, such as a failing batch of disks, is then unlikely to affect both.

One copy off site

At least one copy should be somewhere else: in the cloud or at another location. Fire, flood or theft at the office then can't take out every copy.

Add immutability for ransomware

Modern ransomware looks for backups and tries to delete them. Immutable or air-gapped backups can't be changed or deleted for a set period, even by an administrator account.

Don't forget cloud apps

Microsoft 365 and Google Workspace keep their services running, but they don't protect you from accidental deletion or a compromised account. Back up mailboxes, OneDrive and SharePoint separately.

Test your restores

A backup is only useful if it restores. Schedule regular test restores of files and whole systems, and check backup reports every day. Common gaps we find include:

• Backups failing silently for weeks
• New servers or shares never added to the backup
• Cloud data not backed up at all
• No one knowing how to restore

RPO and RTO in plain language

Two numbers define a good backup plan. Recovery Point Objective (RPO) is how much data you can afford to lose, for example the last four hours of work. Recovery Time Objective (RTO) is how long you can afford to be down while restoring. A small office might accept a day of lost data and a day of downtime; a clinic or trading firm might need minutes. Your backup schedule, storage and recovery method should be chosen to meet these targets.

What to back up

Make sure your plan covers everything, not just the file server:

• File servers and NAS shares
• Databases and line-of-business applications
• Microsoft 365 or Google Workspace mailboxes and drives
• Laptops with locally stored work
• Firewall, switch and phone system configurations
• Virtual machines and cloud servers

Backup vs disaster recovery

Backup means having copies of your data. Disaster recovery means being able to run your business again after a major incident, which needs more than files. It includes the ability to restore whole servers or run them in the cloud, working internet and phone systems, access to key applications and a plan for who does what. Many businesses have backups but no tested recovery plan. Documenting the steps and testing them once or twice a year turns backups into real resilience.

Choosing a backup solution

Look for a backup solution that covers all your systems from one console, including servers, virtual machines, laptops and Microsoft 365 or Google Workspace. It should support scheduled and automatic backups, encryption, immutable storage options, flexible retention and fast restores of both single files and entire systems. Daily reports or alerts are essential so failures are noticed immediately. Managed backup services include monitoring and regular restore testing, which removes the burden from your team and gives you confidence that your data can always be recovered.

Getting started

We can review your current backups against the 3-2-1 rule and close any gaps, usually with automated cloud backup and daily reporting.