I.T. & Security
Backups that actually work: the 3-2-1 rule for small business
Everyone knows they should back up. Far fewer know whether their backup would actually restore - and the moment you find out is the worst possible time. A backup you've never tested is a hope, not a plan. This guide explains the 3-2-1 rule in plain terms and shows you how to set up backups that genuinely work when a laptop is stolen, a drive dies, or ransomware locks your files on a Friday afternoon. You'll learn why three copies, on two types of media, with one kept off-site is the standard that survives real disasters, how to test a restore so you know it works, where cloud backup helps and where it quietly lets you down, and the specific gaps that catch small businesses out. It's written for an owner or office manager, not a technician. Follow it and you'll sleep better - or send it to whoever looks after your I.T. and ask them to prove it.
Why "we back up to the cloud" isn't a plan
The most common answer to "do you have backups?" is "yes, it all syncs to the cloud." The trouble is that sync and backup are different things, and the difference is the whole game. A sync service like OneDrive, Dropbox or Google Drive mirrors your files so the same version appears on every device - which means when a file is deleted, corrupted or encrypted by ransomware, that change is faithfully copied everywhere too. Sync spreads your mistakes at the speed of light.
A real backup is different: it keeps independent, historical copies that you can roll back to a moment before the problem. The test is simple - can you recover a specific file, or your whole system, as it was last Tuesday? If the answer is no, you have sync, not backup. Both are useful, but only one saves you when something goes wrong. A single cloud copy with no version history is a convenience, not a safety net.
The 3-2-1 rule without jargon
The 3-2-1 rule is the backup standard that has survived every fashion in technology because it is really just common sense written down. It means: three copies of your data, on two different types of storage, with one kept off-site.
Three copies is your live working data plus two backups, so that losing any one still leaves you covered. Two types of storage means not putting both backups in the same basket - for example one on a local drive or network device in the office and one in a cloud service - so a single failure can't take out both at once. One off-site is the copy that lives somewhere else entirely, whether that's the cloud or a drive stored in another building, so a fire, flood or theft at your premises doesn't erase everything. In a region that knows its share of floods, that off-site copy is not theoretical.
A modern extension you'll hear is "3-2-1-1-0": add one copy that is offline or immutable (more on that below), and aim for zero errors by actually testing your restores. You don't need to overthink it - if you can honestly tick three copies, two types, one off-site, you are ahead of most businesses.
Testing a restore - the step everyone skips
A backup that has never been restored is an untested assumption, and disasters are a bad time to discover your assumption was wrong. Backups fail quietly all the time - a job that silently stopped months ago, a copy that was only ever grabbing half the folders, an archive that turns out to be corrupt. The only way to know is to try.
Put a restore test in the calendar. The small version takes minutes: pick a file and a folder, restore them to a separate location, and confirm they open and are actually current. Once or twice a year, do the big version - restore a whole system or a full mailbox - and time how long it takes to get back to working. That number is your real recovery time, and it is usually a surprise. Write down who runs the test and how, so it doesn't depend on one person's memory. A backup you have personally watched restore is worth ten you merely hope are running.
Where cloud backup quietly lets you down
Cloud backup is excellent as one leg of the 3-2-1 stool, but it fails people in predictable ways when it is treated as the whole plan. The gaps are almost always the same: only some devices or folders were ever included; the backups have been silently failing for weeks with nobody watching the reports; the retention window is so short that by the time a problem is noticed, the last good copy has already aged out; there is no alerting, so a stopped backup looks exactly like a working one.
The biggest blind spot of all is Microsoft 365 and Google Workspace. People assume that because their email and documents live in a cloud, the provider is backing them up - and the provider is not. That data needs its own dedicated backup just like anything else. Cloud is powerful and worth having; it simply isn't magic, and it needs the same checking, alerting and testing as any other part of your safety net.
Ransomware and the offline copy
Ransomware is the threat that turns a good-enough backup into a useless one. Modern ransomware doesn't just encrypt the files on the infected computer; it actively hunts across the network for connected backup drives and synced cloud folders and encrypts those too, precisely so you can't simply restore your way out. If your backup is reachable from the machine that got hit, assume the attacker can reach it as well.
The defence is a copy the ransomware cannot touch. That means offline - physically disconnected, like a drive that is only plugged in during the backup and then removed - or immutable, a write-once copy that cannot be altered or deleted for a set period even by an administrator. Good modern backup services offer immutable, air-gapped copies as a feature; it is worth asking for by name. Keep at least one backup out of ransomware's reach, and pair it with multi-factor sign-in and regular patching, and you turn a potential business-ending event into a bad afternoon and a clean restore.
The five-minute check to run this week
You don't need a project to find out where you stand - you need five honest minutes. Work down this list:
- List what matters. Name everything that would hurt to lose: your files, email, accounting data, the website, and any line-of-business apps.
- Confirm each is really backed up. Not synced - backed up, with historical restore points.
- Check the last successful backup date for each one. "It's set up" is not the same as "it ran last night."
- Confirm one copy is off-site and one is offline or immutable, so a fire or ransomware can't take the lot.
- Do one test restore of a single real file, and watch it open.
Anything on that list you can't answer with confidence is your gap, and now you know where to point your attention. If you'd rather not guess, send this to whoever looks after your I.T. and ask them to show you a live restore - a good provider will be glad to.