In data recovery jobs I keep seeing the same pattern: there was a backup – but it lived on the same drive, was months old, or got encrypted by the ransomware along with everything else. The 3-2-1 backup rule is a simple standard that prevents exactly these cases, and it works for a two-person office just as well as for a company of fifty.
What the 3-2-1 rule says
The 3-2-1 principle separates your data so that no single failure – whether a dead hard drive, a fire, water damage or ransomware – can wipe out every copy at once.
- 3 copies of your data: your live production data plus at least two independent backups.
- 2 different storage types: for example a local NAS in the office and separate cloud storage – not two partitions on the same disk and not two identical drives plugged into the same machine.
- 1 copy off-site: physically separate from the office and ideally offline or technically immutable.
Want to tackle this in your company?
Send me a short message or give me a call. I'll get back to you within 24 hours on weekdays.
Why one copy must be offline or immutable (3-2-1-1-0)
When the 3-2-1 rule was coined, the main threats were hardware failures and damage to the server room. Today the biggest threat is different: modern ransomware actively scans the network for reachable backups – shared folders, open NAS shares, permanently attached USB drives and synced cloud folders – and encrypts or deletes them before the attack even becomes visible.
That is why IT security practice often extends the classic rule to 3-2-1-1-0: at least 1 copy must be kept completely offline (air-gapped) or stored as immutable storage (object lock / WORM), so that even a compromised administrator account cannot delete or overwrite it before the retention period expires. And the 0 stands for zero unresolved errors in automated backup checks and restore tests.
Why Microsoft 365, OneDrive and RAID are not backups
Two misconceptions show up in small businesses almost every week. First: a RAID array in a server or NAS mirrors disks in real time, which only protects against a single drive failing. If someone accidentally deletes a project folder or malware encrypts your files, that exact change is mirrored onto every drive immediately.
Second: cloud services such as Microsoft 365, OneDrive, SharePoint or Google Workspace sync files, but they do not replace an independent backup. If an account is taken over, mailboxes are wiped or files are overwritten and the recycle-bin retention window passes, the data is gone. Even with a clean Microsoft 365 and Entra ID setup, an independent backup for email, SharePoint and OneDrive belongs in place.
Four mistakes that make backups fail in an emergency
- A permanently connected USB drive: mounted as a normal drive letter on the server, never rotated, and encrypted right alongside the production data during an attack.
- Silent failures without monitoring: the backup job has been failing for three months because a disk filled up or a credential expired, and nobody receives an alert.
- Backing up files only, not whole systems: the documents are safe, but after a server crash it takes days to rebuild the operating system, databases and line-of-business software.
- Recovery keys stored on the dead server: the encryption password for the cloud backup lives only inside a file on the very server that will no longer boot.
The step almost everyone skips: testing restores
A backup only becomes a backup once a restore has demonstrably worked. Under the GDPR, this is a legal requirement too: Art. 32 GDPR explicitly requires the ability to restore personal data quickly after an incident and a process for regularly testing your safeguards (see also IT security for law firms).
At least once a quarter, restore a sample of files; once a year, walk through a full recovery scenario: How long until accounting, email and specialist software are back up? Is a database dump or license key missing? Does anyone else know where the emergency credentials are stored? For a quick baseline across all ten core areas, take the free IT security check.
A concrete setup for an office with 5 to 30 workstations
For small businesses without an internal IT department, a three-tier setup has proven reliable in day-to-day operation:
- Tier 1 – Production data: servers, laptops and Microsoft 365 (Exchange, SharePoint, OneDrive) running on encrypted drives.
- Tier 2 – Fast local recovery: a dedicated NAS in the office pulls automated daily backups and full system images using isolated backup credentials that normal workstations cannot write to.
- Tier 3 – Immutable off-site copy: an encrypted cloud backup replicates recovery points daily to an EU data centre with object lock enabled (immutable for e.g. 30 days) and daily status monitoring.
Backup is not a product you buy once – it is a process with clear responsibilities. I set up 3-2-1 backups for SMEs – including automation, an immutable off-site copy and a documented recovery plan – and can monitor them continuously as part of my IT support for small businesses.