Business backups and the 3-2-1 backup rule explained

We earn a commission if you buy through some links on this page, at no extra cost to you. It never affects the order. How we make money.

The 3-2-1 backup rule is a simple standard for protecting business data: keep three copies of your data, on two different types of storage, with one copy offsite. Following it means a stolen laptop, a failed drive, a ransomware attack or an accidental deletion becomes an inconvenience rather than a disaster. This guide explains the rule, how it applies to cloud apps and websites, how to protect backups from ransomware, how to test restores, and what it costs.

What the 3-2-1 rule means

• 3 copies of your data: the original plus two backups.
• 2 different types of storage: for example, your computer's drive and an external drive, or a server and cloud storage, so one type of failure does not destroy all copies.
• 1 copy offsite: in a different physical location, usually cloud backup, so fire, flood or theft at your office does not destroy everything.

Many organisations now add another layer, sometimes written as 3-2-1-1-0: one copy that is immutable or offline, and zero errors when backups are tested.

Why small businesses lose data

Common causes include hardware failure, lost or stolen laptops and phones, accidental deletion or overwriting, ransomware that encrypts files, compromised accounts where attackers delete data, software bugs and bad updates, and disasters such as fire, flood or power surges. Many small businesses only discover their backups were incomplete when they need them. A simple, tested backup routine prevents this.

What to back up

• Financial records and accounting data.
• Customer and supplier data, contracts and invoices.
• Email, especially if it holds records not stored elsewhere.
• Shared files and documents.
• Your website files and database.
• Product data, photos and marketing assets.
• Configuration of key systems, such as DNS records and software settings.
• Payroll and HR records.

Make a list of where each type of data lives, then check that each location is backed up.

Cloud apps: the shared responsibility trap

Many businesses assume that data in cloud apps, such as email suites, CRM, accounting software and file storage, is automatically backed up. Providers protect against their own infrastructure failures, but they generally do not protect you from your own mistakes, a malicious insider, or an attacker who deletes data using a compromised account. Retention of deleted items is often limited. Check each app's backup and restore options, export data regularly, or use third-party backup services for critical apps such as email and file storage.

Backing up computers

For laptops and desktops, use automatic cloud backup software that runs continuously, plus an external drive or network storage for fast local restores. Store important work in cloud file storage that syncs across devices, but remember that sync is not backup: if a file is deleted or encrypted, the change syncs everywhere. Use versioning, which keeps previous versions of files, and make sure deleted files are retained for a reasonable period.

Backing up your website

Website backups should include files and the database, run automatically, be stored away from the web server, and be kept for several weeks. Many hosts include backups, but check frequency, retention and restore costs. Keep your own copies too, especially before major updates. Website builders handle backups for you but may not allow full exports. See web hosting cost and how to protect a small business website.

Servers and databases

If you run servers or databases on cloud platforms, use snapshots and database backups, store copies in a different region or account, and automate them. Managed database services often include point-in-time recovery. Document how to restore each system. Compare cloud providers in the cloud hosting ranking and managed databases in the serverless databases ranking.

Protecting backups from ransomware

Ransomware attackers often try to delete or encrypt backups before demanding payment. Protect backups by keeping at least one copy offline or immutable, meaning it cannot be changed or deleted for a set period; using separate credentials for backup systems; turning on two-factor authentication for backup accounts; and limiting who can delete backups. See two-factor authentication for small business.

How often to back up

Back up as often as you can afford to lose data. If losing a day of work would be painful, back up at least daily; for busy systems like online stores or accounting, more frequently. This is called your recovery point objective. Also decide how quickly you need systems back after a failure, your recovery time objective, which affects whether you need fast local copies or can rely on slower cloud restores.

Test your restores

A backup is only useful if you can restore from it. Test regularly: restore a few files, a mailbox, a database or the whole website to a test location. Time how long it takes and note any problems. Many businesses discover during a real incident that backups were incomplete, credentials were missing, or restores take far longer than expected. Testing turns assumptions into confidence.

Retention

Keep backups long enough to recover from problems discovered late, such as data corruption or deletion noticed weeks afterwards. A common approach is daily backups kept for several weeks, weekly backups kept for a few months, and monthly backups kept for a year or more. Legal and tax rules may require you to keep certain records for years; check your country's requirements.

Costs

Backup costs include cloud backup subscriptions, often priced per device or per storage amount, external drives or network storage, and third-party backup services for cloud apps. For a small business, the total is usually modest compared with the cost of losing data. Cloud storage prices vary by provider and storage class; archival storage is cheaper for rarely accessed copies.

A simple backup plan for a small business

1. List where all important data lives.
2. Turn on versioning and retention in cloud file storage.
3. Install automatic cloud backup on computers.
4. Back up email and file storage with a third-party service or regular exports.
5. Confirm website backups with your host and keep your own copies.
6. Keep one copy offline or immutable.
7. Protect backup accounts with 2FA.
8. Test restores every quarter and write down the steps.

Common mistakes

• Treating file sync as backup.
• Assuming cloud apps are fully backed up by the provider.
• Keeping all backups in one place.
• Backups accessible with the same credentials as everyday accounts.
• Never testing restores.
• Forgetting website and DNS configuration.

Example: a design studio hit by ransomware

A design studio's shared drive was encrypted by ransomware after a staff member opened a malicious attachment. Because the studio followed the 3-2-1 rule, it had cloud backups with versioning, an external drive backup updated nightly and disconnected after each run, and immutable cloud copies kept for 30 days. It wiped and rebuilt the affected computers, restored files from the previous night's backup, and was working again within two days, without paying a ransom. It then turned on two-factor authentication everywhere and ran phishing training.

Example: a shop that lost a laptop

A shop owner's laptop, containing accounting records and product photos, was stolen from a car. Because files synced to cloud storage with versioning and the laptop had automatic cloud backup, she restored everything onto a new laptop the same week. The laptop's disk was encrypted, so the thief could not read customer data. Without backups, she would have lost years of records needed for tax.

Documenting your recovery plan

Write a short recovery plan: where backups are, who has access, the credentials needed (stored securely in a password manager), and step-by-step restore instructions for each critical system. Include contact details for your IT provider, hosting company and key software vendors. Keep a printed copy somewhere safe, since in a serious incident your computers may be unavailable. Review the plan when systems change.

Backups and data protection law

Backups contain personal data and must be protected like the original data: encrypted, access-controlled and kept no longer than necessary. If a customer exercises a right to deletion, consider how your backups handle it, often by letting backed-up data expire under normal retention. Choose backup providers with clear security and data location information.

Choosing backup tools

• Automatic, scheduled backups with alerts on failure.
• Versioning and adequate retention.
• Encryption in transit and at rest.
• Immutable or offline options.
• Fast, tested restore options.
• Support for your devices, cloud apps and servers.
• Two-factor authentication on the backup account.

For cloud servers and databases, compare provider backup features in the cloud hosting ranking, such as DigitalOcean vs Vultr.

Who is responsible

Assign one person to own backups: checking that backups run, reviewing alerts, organising restore tests and updating the plan. In small businesses, this is often the owner or an external IT provider. Without a named owner, backups tend to fail silently. A short monthly check takes minutes and prevents nasty surprises.

Backing up mobile devices

Phones hold business contacts, photos, messages and authenticator apps. Turn on automatic device backup to the cloud, and make sure business chat apps such as WhatsApp Business back up their messages. Back up or transfer authenticator apps when changing phones. For company phones, mobile device management can enforce backup settings and allow remote wiping if a phone is lost.

Backing up business chat and email

Business conversations increasingly happen in chat tools and WhatsApp. Check whether your tools retain messages and whether you can export them. Email archives hold contracts, approvals and customer history; make sure they are included in backups, especially for departing staff whose mailboxes may be deleted. Set retention policies before you need old messages.

Quarterly restore test checklist

1. Restore a random set of files from last week's backup.
2. Restore a deleted email or mailbox to a test account.
3. Restore the website to a staging location and check it works.
4. Check database backups can be restored.
5. Time each restore and record the result.
6. Fix any failures and update the recovery plan.

Small business backup budget

A typical small business backup setup includes cloud backup for each computer, a backup service or regular exports for email and file storage, website backups from the host plus your own copies, and an external drive for fast local restores. Costs are usually a modest monthly amount per device or user plus storage. Compare that with the cost of a week without your data, or of paying a ransom, and backups are among the best-value investments in IT.

Backups as part of wider security

Backups are your last line of defence; other measures reduce how often you need them. Protect accounts with a password manager, train staff to spot phishing and invoice fraud, keep devices updated, and use a VPN on public networks. Together with tested backups, these steps protect most small businesses from the incidents that cause the worst data losses.

Questions