What the 3-2-1 backup rule means, how to apply it to office files, email and websites, and why an untested backup is not a backup.
A failed hard disk, a stolen laptop, ransomware, or an accidental "delete all" — every business eventually loses data. Whether that is an inconvenience or a disaster depends entirely on backups. The 3-2-1 rule is the simplest reliable plan.
What 3-2-1 means
- 3 copies of your data: the original and two backups.
- 2 different types of storage: for example, an external drive and cloud storage.
- 1 copy off-site: somewhere a fire, theft or flood at the office cannot reach.
Many teams now add a fourth point: keep at least one copy that cannot be changed or deleted for a period of time (an "immutable" or offline copy). This protects against ransomware, which tries to encrypt or delete every backup it can reach.
Applying it to a small office
| What | Copy 1 (original) | Copy 2 | Copy 3 (off-site) |
|---|---|---|---|
| Office documents | Shared drive / laptops | External drive or NAS, nightly | Cloud backup service |
| Business email | Email provider | Provider's retention settings | Third-party email backup or periodic export |
| Website | Hosting server | Hosting provider's daily backups | Weekly download to your own cloud storage |
| Accounting data | Accounting software | Software's own backup | Encrypted copy in cloud storage |
Sync is not backup
Tools like Google Drive, OneDrive and Dropbox sync files between devices. If a file is deleted or encrypted by ransomware on one computer, that change syncs everywhere. Version history helps, but it is not a substitute for a separate backup with its own retention.
Test your restores
The most common backup failure is discovering, on the day you need it, that the backup stopped working months ago. Once a month, restore one file. Once a year, restore everything — for example, the whole website onto a staging server — and time how long it takes.
A simple starting plan
- List what would hurt most to lose (client files, accounts, website, email).
- Set up automatic nightly backups to one local and one cloud destination.
- Turn on email alerts for backup failures — and make sure someone reads them.
- Put a monthly restore test in the calendar.
More guides
Spotted a mistake? Email support@cygnatrix.com and we will correct it. See our editorial policy.