The 3 2 1 Backup Rule Explained for Small Businesses
The 3 2 1 rule is the simplest way to check whether your backups would really save you. Here is what it means, the modern 3 2 1 1 0 version, and how to apply it to a typical North East business.
Key takeaways
- A continuity plan answers one question: how do we keep serving customers when something goes wrong?
- Start with your critical activities and the systems, people and suppliers they depend on.
- The IT disaster recovery section should say what gets restored, in what order, by whom and from where.
- Keep the plan short, store a copy outside your own systems and test it at least once a year.
Every business has a plan for when things go wrong. For many, it lives in the owner's head and goes something like "ring the IT company and hope". That works until the day the person who knows everything is on holiday, the office is flooded, or ransomware has locked every computer and the phone numbers you need were stored on them. A written business continuity plan does not need to be long or complicated. It needs to be clear, current and somewhere you can find it in a crisis.
Business continuity and disaster recovery: what is the difference?
Business continuity is about the whole business: how you keep serving customers, paying staff and meeting your obligations during and after a disruption. That could be a power cut, a building you cannot get into, a key supplier going bust or illness among staff.
IT disaster recovery is the part of continuity that deals with technology: how you get systems and data back after a failure or attack. For most modern businesses it is the biggest part of the plan, because almost every activity depends on IT.
A small business can usually combine both in one document. Larger or regulated organisations sometimes work towards the international standard ISO 22301, but you do not need to follow a formal standard to get real value from a simple plan.
Step 1: work out what really matters
Start with a short business impact analysis. That sounds grand, but it is simply a list of the activities your business cannot do without, and how long you could cope without each one.
- What do customers rely on you for every day?
- What must happen for staff to be paid and suppliers to be paid?
- Which legal or contractual deadlines could you miss?
- For each activity, which systems, data, people, premises and suppliers does it depend on?
For each critical system, agree how much data you could afford to lose and how long you could be without it. These are your recovery point and recovery time objectives, explained in our guide to the 3 2 1 backup rule.
Step 2: think through likely scenarios
You cannot plan for everything, so plan for outcomes rather than causes. Most incidents boil down to a handful of situations:
- We cannot use the office.
- We have lost access to some or all of our IT systems or data.
- We have lost our internet connection or phone lines.
- A key person is unavailable.
- A key supplier has failed.
- We have had a cyber attack or data breach.
For each one, write a few lines on what you would do in the first hour, the first day and the first week. Cyber incidents deserve their own section, because they bring extra steps such as contacting your insurer and deciding whether to report to the Information Commissioner's Office.
A business continuity plan template
Here is an outline you can copy. Keep each section short. Bullet points and tables are better than paragraphs when people are under pressure.
| Section | What to include |
|---|---|
| 1. Purpose and scope | What the plan covers, which sites and teams, and when it was last reviewed |
| 2. Who decides | Who can invoke the plan, who leads the response and their deputies |
| 3. Contact lists | Staff, IT provider, internet and phone providers, insurer, landlord, bank, key clients and suppliers, with out of hours numbers |
| 4. Critical activities | The list from your impact analysis, with how long each can be paused |
| 5. Systems and data | Each critical system, where it lives, who supports it and its recovery targets |
| 6. IT recovery steps | Restore order, where backups are, how to access them and who does it |
| 7. Working elsewhere | How staff work from home or another site, which devices they use and how calls are redirected |
| 8. Communications | Who tells staff, customers and suppliers, with message templates |
| 9. Cyber incident and data breach | Containment steps, insurer notification, ICO reporting decision and evidence to keep |
| 10. Returning to normal | How you check systems are clean and complete, and how you review what happened |
| 11. Testing and review | When the plan is tested, who signs it off and the date of the next review |
Writing the IT disaster recovery section
This is where most plans are too vague. "Restore from backup" is not a plan. A useful IT recovery section answers:
- What gets restored first? Usually identity and email, then the systems that earn money, then everything else.
- Where are the backups and how do we reach them if our own systems, passwords or office are unavailable?
- Who does the work, and how do we contact them out of hours?
- What hardware do we need? Can we get replacement laptops quickly, or do we keep spares?
- How do we keep talking? Cloud phone systems can be redirected to mobiles or home workers, which is one reason many businesses are moving to hosted business phones. A backup internet connection can also keep the office running if the main line fails.
- Where are the admin credentials and licence details? Keep a secure record that is accessible even if your main systems are down, for example in a business password manager with emergency access.
Keep a printed copy, or a copy in a separate location, of the plan itself and the key contact numbers. A plan stored only on the server that has just failed is not much use.
Testing and keeping the plan alive
A plan that has never been tested usually fails at the first hurdle: a phone number is out of date, a backup is missing a system, or nobody remembers where the admin password is. Testing does not need to be disruptive.
- Tabletop exercise: sit round a table for an hour, pick a scenario and walk through the plan step by step. The NCSC offers a free tool called Exercise in a Box that small organisations can use to practise their response to cyber incidents.
- Technical test: restore a real system from backup and time it.
- Remote working test: have a team work from home for a day using only what the plan says they will have.
Review the plan at least once a year and whenever something big changes, such as moving office, changing IT provider or adopting a new core system.
How Cyber Fits can help
We help businesses in Sunderland and across the North East write the IT side of their continuity plans, set up backups that meet their recovery targets and run test restores. If you would like help getting started, see our backup and recovery and managed IT support services, or book a free IT review.
Frequently asked questions
Does a small business need a business continuity plan?
There is no general legal requirement for most small businesses, but clients, insurers and regulators increasingly ask about one. More importantly, a short written plan makes a real difference to how quickly you recover from an incident.
How long should a business continuity plan be?
For a small business, a few pages is often enough. It should be short enough that people will read it in a crisis, with clear contacts, priorities and recovery steps.
How often should we test our continuity plan?
At least once a year, and whenever something significant changes such as an office move or a new core system. A one hour tabletop exercise is a good start.
What is the difference between business continuity and disaster recovery?
Business continuity covers keeping the whole business running during a disruption. Disaster recovery is the part that deals with restoring IT systems and data.
Written by the Cyber Fits team
IT support and cyber security, Sunderland
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.