The 3 2 1 backup rule is the simplest backup plan that actually works. Keep three copies of your data, store them on two different types of storage, and keep one copy offsite. Photographers used it long before cloud storage existed, and IT teams still use it because it answers the only question that matters after a disaster: can we get our data back?
This guide explains the 3 2 1 backup rule in plain language, shows how a small or midsize business can follow it without a big budget, and covers the extra steps that modern ransomware has made necessary.
What the 3 2 1 backup rule means
Each number in the 3 2 1 backup rule protects you from a different kind of failure.
- 3 copies of your data. The live data your team works on, plus two backups. If one backup is damaged, you still have another.
- 2 types of storage. For example a backup server or storage device in the office and a cloud storage service. A fault that hits one kind of storage rarely hits the other.
- 1 copy offsite. A fire, flood or theft at the office cannot reach a copy that lives somewhere else.
The rule is easy to remember, which is part of its value. Anyone in the business can ask whether you follow the 3 2 1 backup rule and get a clear yes or no.
Why one backup is never enough
Many companies have a single backup and feel safe. Then the backup drive fails on the day it is needed, or the backup sits on the same server that ransomware just encrypted, or nobody noticed that the nightly job stopped running six weeks ago.
Each of these failures is common. A single copy turns any one of them into lost data. Following the 3 2 1 backup rule means a second, separate copy is waiting when the first one lets you down.
Backups also fail quietly. A job can report success while skipping locked files or a database that was busy. That is why testing restores, covered below, matters as much as making copies.
The 3 2 1 backup rule against ransomware
Ransomware changed backup planning. Attackers now look for backups first, because a company that can restore its data has no reason to pay. If your backup server can be reached with the same admin password as everything else, it will be encrypted along with the rest.
The answer is to extend the 3 2 1 backup rule with two more numbers, often written as 3 2 1 1 0:
- 1 immutable or offline copy. An immutable backup cannot be changed or deleted for a set number of days, even by an administrator. An offline copy is disconnected entirely.
- 0 errors after testing. Restores are tested on a schedule, and every error is fixed before the next test.
The US Cybersecurity and Infrastructure Security Agency recommends offline, encrypted backups that are tested regularly in its StopRansomware guidance. Those steps sit on top of the 3 2 1 backup rule rather than replacing it.
How to apply the 3 2 1 backup rule in a small business
You do not need a data centre to follow the 3 2 1 backup rule. A typical setup for a company with a few servers and Microsoft 365 looks like this:
- Copy one: your live data on servers, laptops and in Microsoft 365 or Google Workspace.
- Copy two: a nightly backup to a storage device in the office, which makes everyday restores fast.
- Copy three: a copy sent offsite to cloud storage with immutability switched on, so ransomware cannot delete it.
Backup software such as Veeam backup handles all three steps from one console, including copies of Microsoft 365 mail, OneDrive and SharePoint, which many companies wrongly assume Microsoft backs up for them.
Cloud apps still need the 3 2 1 backup rule
Microsoft 365 and Google Workspace keep your data available, but availability is not backup. If a user deletes a folder, a mailbox is wiped when someone leaves, or ransomware syncs encrypted files into OneDrive, the service will faithfully keep the damaged version.
Retention settings help for a while, but they are not a separate copy. Treat cloud apps like any other system under the 3 2 1 backup rule: back them up to storage you control, with at least one copy outside the vendor that runs the app.
Testing: the step most teams skip
A backup you have never restored is a hope, not a plan. Set a simple schedule:
- Every month, restore a few files and one mailbox to prove day to day restores work.
- Every quarter, restore a whole server into an isolated test network and check that it starts and its applications open.
- Every year, run a recovery exercise with the people who would be involved in a real incident.
Write down how long each restore took. Those numbers tell you whether your recovery time matches what the business expects, and they are useful evidence in a cyber security audit.
Common mistakes with the 3 2 1 backup rule
We see the same gaps again and again when we review backup setups:
- The offsite copy uses the same login as the main network, so an attacker who gets in can delete it.
- Backup alerts go to one person who left the company.
- Laptops and cloud apps are not backed up at all.
- Backups are kept for seven days, so a problem noticed after two weeks cannot be fixed.
- Nobody has tested a full restore since the system was set up.
Each of these is cheap to fix once it is found. Our IT support services include checking backup jobs and alerts as part of routine monitoring.
How much storage does the 3 2 1 backup rule need?
Plan for roughly two to three times your current data, depending on how long you keep backups and how much changes each day. Modern backup software stores only the changes after the first full copy and compresses the data, so the real figure is often lower.
Cloud storage for the offsite copy is usually priced per terabyte per month. Immutable storage costs a little more, but it is the copy that saves you when everything else is encrypted, so it is worth paying for.
Where ApexGenTech helps
We design backup plans around the 3 2 1 backup rule for companies in Canada, the UK, the UAE, Saudi Arabia, Qatar and Pakistan. As an authorised reseller we supply Veeam and Microsoft 365 licences, set up immutable offsite copies, and test restores with you.
If you are not sure whether your current setup would survive ransomware, our penetration testing team can check whether an attacker could reach your backups, and our cybersecurity services cover the rest of the picture.
Recovery time and recovery point: set your targets
Before choosing tools, agree two numbers with the business. The recovery point objective is how much recent data you can afford to lose, such as one day or one hour. The recovery time objective is how long a system can be down before the damage becomes serious.
These targets shape how you apply the 3 2 1 backup rule. A shop that can rebuild one day of sales from paper receipts can back up nightly. An online store that takes orders every minute needs backups every few minutes and a fast way to restore. Write the targets down for each system, because a single target for the whole company is usually too strict for some systems and too loose for others.
- Accounts and ERP: often a few hours of acceptable data loss and a recovery within one working day.
- Email: people can usually wait a few hours, but nobody can wait a week.
- File shares: nightly backups are often enough, with fast restores of single files.
- Customer facing systems: the tightest targets, and often worth a standby copy.
Who should own backups
Backups fail when everyone assumes someone else is watching them. Name one owner for backup jobs, alerts and restore tests, and a deputy who covers holidays. If you use an IT partner, write backup duties into the service agreement so there is no doubt about who checks what.
The owner should report to management once a quarter with three facts: did every backup run, when was the last successful restore test, and how long did it take. That short report keeps the 3 2 1 backup rule visible and turns backup from a technical detail into something the business understands and funds.
Keep the recovery plan where people can reach it during an outage. A plan stored only on the server that just failed is no help. Print a copy, store one offsite and make sure at least two people know where both are.
3 2 1 backup rule FAQs
Is the 3 2 1 backup rule still enough today?
It is still the right starting point, but add an immutable or offline copy and regular restore tests. That extended version, often called 3 2 1 1 0, is what protects you from ransomware.
Does cloud storage count as offsite?
Yes, as long as it is a separate account with its own credentials and, ideally, immutability. A synced folder that mirrors your files does not count, because deletions and encryption sync too.
How often should backups run?
Most businesses run nightly backups for servers and several times a day for busy databases. Decide how much data you could afford to lose, then set the schedule to match.
Do small companies really need the 3 2 1 backup rule?
Small companies often have the most to lose, because one bad day can wipe out invoices, customer records and years of work. The 3 2 1 backup rule costs little to follow and removes that risk.
Want a second opinion on your backups? Contact us and we will review your setup against the 3 2 1 backup rule and tell you plainly what to fix first.
