The 3-2-1 backup rule for a small business
The 3-2-1 rule is simple: keep 3 copies of your important data, on 2 different types of storage, with 1 copy somewhere else (off-site). CISA's small business guidance describes it this way. It protects you from a dead laptop, a fire, ransomware, and an accidental deletion.
Step 1: List what you cannot afford to lose
- Accounting and invoice records
- Customer list and notes
- Contracts, quotes, signed documents
- Photos, project files, price lists
- Website files and database
- Email archives
Step 2: Do not forget data that lives in cloud apps
Many people assume a cloud service is a backup. It is not. If you delete something, or an account is hijacked, the deletion can sync everywhere. Your accounting tool, CRM, email, shared drive, website builder and booking system all hold data you should export on a schedule.
- Look in each app for Export, Download my data, or Backup in settings.
- For Google accounts, check Google Takeout. For other vendors, search "[vendor name] export data".
- Note how long the vendor keeps deleted items. This varies by plan and vendor.
Step 3: Build the three copies
- Copy 1: the working data on your computer or in your cloud app.
- Copy 2: a local copy on a different kind of media, such as an external drive or a small network drive.
- Copy 3: an off-site copy, such as an encrypted cloud backup service or a drive kept somewhere other than your business location.
CISA recommends protecting backups with encryption and keeping an offline copy. Its ransomware guide explains why: attackers often look for and delete or encrypt backups they can reach, and a cloud sync can copy encrypted files over good ones. An external drive that is unplugged after backup, or a cloud service with versioning that lets you roll back several days, handles this.
Step 4: Test a restore
A backup you have never restored is a hope, not a backup. At least every few months, pick a random file and one whole folder and restore them to a different location. Open them. Time how long it took. Write the steps in a short text file stored with the backup so that anyone can follow them.
The monthly 15-minute routine
- Minutes 1 to 3: check that the automated backup ran. Look at the date of the most recent backup. Fix errors.
- Minutes 4 to 8: export data from the cloud apps that do not back up automatically. Save to your local drive, with the date in the file name.
- Minutes 9 to 12: restore one random file from each copy. Open it.
- Minutes 13 to 14: swap or unplug the external drive, and confirm that the off-site copy is current.
- Minute 15: note the date and anything odd in a one-line log.
Common mistakes
- Keeping the backup drive always plugged into the same computer.
- Relying only on a sync folder.
- Storing the backup password only on the machine that failed. Keep it in your password manager and on paper in a safe place.
- Never checking that backup jobs are still running after a software update.