The 3-2-1 rule and its newer version
| Number | Meaning | Example in a small business |
|---|---|---|
| 3 | Three copies of the data, counting the original | Data on the server, a copy on a network drive, a copy in the cloud |
| 2 | On two different types of media | A drive in the office and space with a cloud provider |
| 1 | One copy off-site | The cloud or a drive taken home |
| 1 (newer) | One immutable or disconnected copy | A cloud copy with deletion lock, or a detachable drive |
| 0 (newer) | Zero errors in the restore test | A verified restore, not just a green status |
Syncing is not a backup
A cloud drive that syncs a folder is a convenience, not protection. When someone accidentally deletes a folder or ransomware encrypts the files, the sync obediently repeats it in the cloud. Some services have a bin and version history, but usually for a limited time and not always for all files.
An external drive permanently connected to the computer doesn't protect against ransomware: it gets encrypted along with everything else. A ransomware-resistant copy has to be disconnected or immutable.
How much you can lose and how fast you must be back
- How much data you can lose
If the backup runs once a day, in the worst case you lose a day's work. If that's too much, backups have to be more frequent. The technical term is RPO.
- How fast you must be back at work
Restoring a whole server from the cloud can take many hours. If the company can't wait that long, a local copy or spare hardware is needed. The technical term is RTO.
These two answers decide how frequent the backups must be and where they should be kept. Without them it's easy to overpay or, more often, to have a backup that isn't enough in practice.
What to back up
- drives with documents and shared folders,
- email, including cloud email, because the contract with the provider usually doesn't cover restoring your data after your own mistake,
- program databases: accounting, sales, warehouse,
- the website: files and database,
- configuration: router, server, program settings, passwords in the password manager,
- a list: what is where and how to restore it.
A restore test once a quarter
The restore instructions should be printed or kept outside the systems that can fail. When the server is down, instructions stored only on it won't help.
Terms from this guide
- Ransomware
Malicious software that encrypts data and demands a ransom to unlock it. The best protection is a backup that can't be changed or deleted.
- The 3-2-1 rule
Three copies of the data, on two different types of media, one of them off-site.
- RPO and RTO
RPO is the amount of data a company can afford to lose (for example one day). RTO is the time within which it must be back at work after a failure.
Questions and answers
How often should backups run?
As often as the amount of data you can afford to lose. For most small businesses a daily backup with version history is a sensible minimum, and more often for data that changes constantly.
Is the cloud provider's backup enough, for example for email?
The provider protects its infrastructure but usually isn't responsible for your mistakes, for example an employee deleting data. A separate backup gives you independence.
How long should backups be kept?
It depends on the type of data and the law, for example accounting rules. A practical rule: a few daily, a few weekly and a few monthly copies, so you can go back to the state before a problem that was noticed late.
Sources and documentation
- NCSC (UK): offline backups in an online worldncsc.gov.uk
- NCSC: the small organisations guide to cyber securityncsc.gov.uk
- Backblaze: the 3-2-1 rule with examplesbackblaze.com