What 3-2-1 actually means
The 3-2-1 rule is simple to state and easy to get wrong in practice: keep at least three copies of your data, on two different types of storage media, with at least one copy stored offsite or offline. The value of the rule is that it survives multiple kinds of failure at once, not just one.
- Three copies: the working data plus two backups, so a single failure never leaves you with zero copies
- Two media types: for example, a local network drive plus a cloud backup, so a single storage failure does not take out everything
- One offsite or offline copy: physically or logically separated so ransomware, fire, or theft cannot reach all copies at once
Why ransomware made the 'one offline copy' rule non-negotiable
Modern ransomware actively searches for and encrypts connected backup drives and network shares, specifically because businesses rely on them to avoid paying. A backup that stays permanently connected to the network is not meaningfully different from the production data it is supposed to protect during a ransomware event.
What this looks like for a small business without an IT team
You do not need enterprise infrastructure to apply this properly. A practical small-business setup usually looks like a small combination of tools already available.
- Primary copy: your live working files in Microsoft 365, Google Workspace, or a local server
- Second copy: a cloud backup service that keeps versioned history, separate from your everyday file storage
- Offline or immutable copy: a rotated external drive kept disconnected when not backing up, or a cloud backup with immutability/versioning that ransomware cannot silently overwrite
- Automate the schedule; a backup that depends on someone remembering to run it manually will eventually be missed
The step almost everyone skips: testing restores
A backup you have never restored from is a guess, not a plan. The worst time to discover a backup is corrupted, incomplete, or missing key files is during an actual incident.
- Schedule a test restore at least quarterly, even a partial one covering a few important files
- Time how long a full restore would realistically take, since this affects how you communicate downtime during a real incident
- Confirm backups actually capture what matters: email, shared drives, line-of-business application data, not just one folder
Matching backup frequency to what you can afford to lose
How often you back up should be driven by how much data loss the business could tolerate, not by a default setting.
- Daily backups are a reasonable baseline for most small businesses
- Businesses processing frequent transactions or client updates may need more frequent or continuous backup for critical systems
- Retain enough historical versions to recover from an incident discovered days or weeks after it started, not just the most recent version
Frequently asked questions
Is cloud storage like OneDrive or Google Drive a backup?
Sync is not the same as backup. If a file is deleted, corrupted, or encrypted by ransomware on your device, that change syncs to the cloud too. True backup means a separate, versioned copy that can be rolled back to a point before the damage happened, which most sync-only tools do not fully provide without a proper backup add-on.
How many backup versions should we keep?
Enough to restore from a point before an incident was detected, which can be weeks in some ransomware or business-email-compromise cases. A common practical approach is 30 to 90 days of retained versions for most small-business data.
What is the minimum viable version of 3-2-1 for a very small business?
At minimum: your live data, a cloud backup service with version history, and one copy kept disconnected from the network (an external drive rotated weekly, or a cloud backup with immutable/versioned storage ransomware cannot overwrite). That covers the most common failure modes without requiring dedicated IT staff.