The 3 2 1 rule is the simplest way to check whether your backups would really save you. Here is what it means, the modern 3 2 1 1 0 version, and how to apply it to a typical North East business.
Most businesses have some kind of backup. The question is whether it would actually get you working again after a bad day: a failed server, a stolen laptop, a flood in the office or a ransomware attack that encrypts everything it can reach. The 3 2 1 backup rule is a simple test you can apply to your own setup in a few minutes, and it is still one of the most useful ideas in IT.
The rule has three parts:
The idea is that no single event, whether a hardware fault, a mistake, a disaster or an attacker, should be able to destroy every copy at once.
Ransomware changed the picture. Attackers now deliberately look for backups and try to delete or encrypt them before they demand payment. The UK's National Cyber Security Centre (NCSC) warns in its guidance on offline backups that ransomware has encrypted not just original data but also connected USB drives and network storage holding backups. That is why many IT providers now talk about 3 2 1 1 0:
The NCSC's advice for small organisations follows the same thinking: make sure at least one backup is not permanently connected to your live systems, and that you can actually restore from your backups.
Before choosing how to back up, it helps to answer two questions. IT people give them acronyms, but the ideas are simple.
If your systems failed right now, how far back could you go without serious harm? If you back up once a night and the server fails at 4pm, you lose a day's work. For an accountant in January, that might be painful. For a busy online shop, it could be very costly. Your RPO tells you how often you need to back up.
How long could the business cope without a system before it really hurts? An hour? A day? A week? Restoring a whole server from cloud storage over a typical office connection can take far longer than people expect. Your RTO tells you how quickly you need to be able to restore, and whether you need a local copy or a standby system to hit it.
Answer these for each important system, not just the business as a whole. Email, your accounts package and your shared files may all have different answers.
Here is how a typical business of 10 to 50 staff might apply the rule. Your setup may be different, but the pattern is the same.
| Data | Copy 1 (live) | Copy 2 | Copy 3 (offsite and protected) |
|---|---|---|---|
| Microsoft 365 email, OneDrive, SharePoint and Teams | Microsoft 365 | Built in retention and recycle bins (short term only) | Independent Microsoft 365 backup to separate cloud storage |
| On premises server or line of business software | The server | Local backup device or storage for quick restores | Encrypted, immutable cloud backup |
| Laptops and desktops | The device | Files kept in OneDrive or SharePoint rather than only on the device | Covered by the Microsoft 365 backup |
| Cloud software such as accounts or CRM | The supplier's platform | Regular exports where the software allows it | Exports stored in your own backed up storage |
Two common traps: first, a USB drive that stays permanently plugged into the server is not offsite and not offline. Second, file sync is not backup. If a file is deleted or encrypted, sync faithfully copies that change everywhere. Our article on whether Microsoft 365 backs up your data explains this in more detail.
A backup job that reports "success" every night only tells you that the software ran. It does not tell you that the right data was included, that the files are readable or that you know how to get them back under pressure. Testing is what turns a backup into a recovery plan.
A sensible routine for a small business:
We design, monitor and test backups for businesses in Sunderland and across the North East, covering Microsoft 365, servers and cloud systems. If you would like a second opinion on whether your backups meet the 3 2 1 rule, see our backup and recovery service or book a free IT review.
Keep three copies of your data, on two different types of storage, with one copy offsite. It means no single failure, disaster or mistake can destroy every copy.
It is an updated version of the rule. On top of 3 2 1, keep one copy offline or immutable so ransomware cannot reach it, and make sure test restores complete with zero errors.
Cloud storage is a good way to keep a copy offsite, but it should be separate from your live systems and ideally immutable. The NCSC points out that cloud storage cannot simply be unplugged, so it needs to be digitally separated from your normal accounts.
Restore a few files every month, a larger restore such as a full mailbox every quarter, and a complete system at least once a year. Record the results and how long each restore took.
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.
Book a free, no obligation IT review. We will look at your setup, tell you honestly what needs attention and give you a clear fixed monthly price.
