The 3-2-1 backup rule, explained for busy business owners

Almost every business believes it has backups. Far fewer have tested whether those backups can bring the business back after a ransomware attack, a failed server or a deleted folder. The 3-2-1 rule is a simple way to check.

What 3-2-1 means

• 3 copies of your data: the live data plus two backups.
• 2 different types of storage: for example a NAS in the office and cloud storage.
• 1 copy off-site: somewhere a fire, flood or theft at the office cannot reach.

The idea is that no single failure, whether a disk, a building or a mistake, can take out every copy at once.

Why ransomware changed the rule

Modern ransomware does not only encrypt your files. It looks for backup software and network storage and tries to destroy those too, because a victim with good backups does not pay.

That is why many teams now follow 3-2-1-1-0:

• 1 immutable or offline copy that cannot be changed or deleted for a set period, even by an administrator account.
• 0 errors after verification, meaning backups are checked and test restores succeed.

Does Microsoft 365 need a backup?

Yes. Microsoft keeps the service running, but deleted items and older versions are only kept for limited periods. If a user deletes a folder, leaves the company, or ransomware syncs encrypted files to OneDrive, a separate backup of mail, OneDrive, SharePoint and Teams is what lets you recover cleanly.

A five-minute backup health check

Ask whoever looks after your IT these questions:

1. Which systems are backed up: servers, NAS, Microsoft 365, laptops?
2. Where are the copies kept, and is one of them off-site?
3. Is at least one copy immutable or offline?
4. Who checks that backup jobs succeed, and how often?
5. When was the last test restore, and how long did it take?

If the answer to the last question is "never", that is the place to start.

Recovery targets

Two numbers turn backups into a plan:

• Recovery point objective (RPO): how much data you can afford to lose, for example four hours of work.
• Recovery time objective (RTO): how quickly you need systems back, for example by the next morning.

Agree these for your critical systems, then check that your backup schedule and restore process can meet them. If you would like help, we can review your current setup and test a restore with you.