The 3-2-1 Backup Rule: How to Protect Your Business Data from Loss and Ransomware
Hardware fails, people delete files and ransomware encrypts everything it can reach. The 3-2-1 backup rule is a simple, proven way to make sure you can always recover.
Data loss rarely announces itself. A disk fails, a laptop is stolen, an employee deletes the wrong folder, a software update corrupts a database, or ransomware encrypts every file it can reach. In each case, the only question that matters is: can you restore what you lost, and how quickly?
The 3-2-1 backup rule is a long-standing and widely recommended answer.
The rule
- 3 copies of your data — the original plus two backups.
- 2 different types of storage — for example, a local disk or NAS and cloud storage — so one failure type cannot destroy everything.
- 1 copy off-site — in a different physical location, such as a cloud provider, so a fire, flood or theft does not take all copies.
The modern extension: 3-2-1-1-0
Ransomware changed backup thinking, because attackers now deliberately look for and destroy backups before encrypting systems. Many organisations therefore extend the rule:
- 1 copy that is offline, air-gapped or immutable — it cannot be changed or deleted, even by an administrator account, for a set period. Cloud object storage with object lock or versioning can provide this.
- 0 errors — backups are verified and restores are tested.
What to back up
- Websites and applications — files, uploaded media and the database. Code should also live in a version control system such as Git.
- Business files — documents, spreadsheets, designs, contracts.
- Email and SaaS data — many SaaS providers keep your data available, but their retention and recovery options may not match your needs. Check what is covered and for how long.
- Configurations — DNS records, server settings, environment variables (stored securely), so you can rebuild quickly.
Two numbers to decide
| Term | Question it answers | Example |
|---|---|---|
| RPO — Recovery Point Objective | How much data can we afford to lose? | "At most one day" → back up at least daily |
| RTO — Recovery Time Objective | How long can we be down? | "Four hours" → restores must be fast and rehearsed |
An online store taking orders all day needs a much smaller RPO than a brochure website updated monthly.
Good backup practices
- Automate — manual backups are forgotten.
- Keep history — several daily, weekly and monthly versions, so you can go back before a problem started. Ransomware or corruption may be discovered days later.
- Encrypt backups in transit and at rest, and protect the keys.
- Separate access — backup storage should use different credentials from your main systems, with multi-factor authentication.
- Monitor — get alerts when a backup fails.
Test your restores
A backup is only proven when you have restored from it. Schedule regular restore tests: bring back a website to a test environment, open restored files, check the database is complete. Write down the steps so anyone on the team can follow them under pressure.
Nobody cares whether you have backups. They care whether you can restore.
A simple setup for a small business
- Website: daily automatic backups by the host, plus a second daily copy to separate cloud storage with versioning.
- Files: a cloud drive for daily work, plus a separate backup service or NAS with versioning.
- One immutable or offline copy updated regularly.
- A quarterly restore test and a written recovery checklist.
Key takeaways
- 3 copies, 2 storage types, 1 off-site — plus 1 immutable or offline copy and 0 unverified backups.
- Decide your RPO and RTO, then design backups to meet them.
- Automate, keep history, encrypt and separate access.
- Test restores regularly — that is the only real proof.
How Wintecsys can help
We set up automatic, off-site and versioned backups for websites, databases and applications, document the restore process and test it — as part of our maintenance and cloud services.
See our maintenance services or review your backups with us.
