June 22, 2026 · 5 min read
The 3-2-1 Rule: Backups That Actually Work When It Matters
In data recovery jobs I keep seeing the same pattern: there was a backup — but it lived on the same drive, was months old, or got encrypted by the ransomware along with everything else. The 3-2-1 rule is a simple standard that prevents exactly these cases, and it works for a two-person office just as well as for a company of fifty.
What the rule says
- 3 copies of your data: the original plus two backups.
- 2 different media: e.g. a NAS in the office and cloud storage — not the same USB drive twice.
- 1 copy off-site: physically separate and ideally offline or immutable.
Why one copy must be offline
Modern ransomware actively hunts for reachable backups — network shares, NAS exports, connected USB drives — and encrypts them first. A copy that is physically disconnected or technically immutable is your last line of defense. Cloud backups with versioning and delete protection serve the same purpose.
The step almost everyone skips: testing restores
A backup only becomes a backup once a restore has demonstrably worked. At least quarterly, restore a few sample files; once a year, run through a full recovery scenario: How long does it take? Is anything missing? Does anyone besides a single person know the procedure?
A concrete setup for a small business
A proven setup: working data lives on a server or in Microsoft 365. A NAS in the office pulls automated daily backups. In addition, an encrypted cloud backup with versioning runs to a European provider. Critical systems are saved as full images, so in an emergency you can restore entire machines, not just files.
Backup is not a product you buy once — it's a process with clear responsibilities. I set up 3-2-1 backups for SMEs, including automation, monitoring and a documented recovery plan.