The 3-2-1 Backup Rule: Would Your Business Survive Data Loss?

Ask most business owners whether they have backups and the answer is yes. Ask when a restore was last tested and the room goes quiet. Data loss rarely comes from the disaster people imagine; it comes from a deleted folder nobody notices for a month, a failed drive, or ransomware that quietly encrypted the backups first. The 3-2-1 rule exists because it survives all three.

The rule in one paragraph

Keep three copies of your data, on two different types of storage, with one of them offsite. The live copy on your machines, a local backup you can restore from quickly, and an offsite copy that survives whatever happens to the building or the network. Each element covers a different failure, which is why shortcuts on any of them eventually get punished.

Why 'it syncs to the cloud' is not a backup

OneDrive, Dropbox and Google Drive are synchronisation, not backup. If a file is deleted or encrypted on your laptop, the damage syncs everywhere within seconds, faithfully and automatically. Version history helps for a single file, but recovering an entire business from sync-service version history after ransomware is somewhere between painful and impossible. Sync is for working; backup is for surviving.

Ransomware changed the maths

Modern ransomware hunts backups first, because attackers know an intact backup means nobody pays. That is why at least one copy should be offline or immutable: disconnected from the network, or written to storage that cannot be altered or deleted for a set period. If your backup system is a drive that is permanently plugged in and visible to every PC, it is one infection away from encrypting alongside everything else.

The failures we actually see

• Backups that stopped running months ago, with nobody watching the alerts.
• Everything backed up except the one system that mattered, usually the accounts package or a database.
• Backups stored on the same server they were protecting.
• Restores never tested, discovered broken on the worst possible day.

Test it or it does not count

A backup you have never restored is a hope, not a plan. Twice a year, pick a file, a folder, and ideally a whole machine, and actually restore them. Time it. The two numbers that matter to your business are how much data you can afford to lose (which sets how often backups run) and how long you can afford to be down (which sets what you invest in recovery). Until you have tested, both numbers are guesses.

Getting it handled properly

We design and run backup and recovery for businesses as part of managed IT: 3-2-1 by default, immutable offsite copies, monitored jobs with alerts a human actually reads, and scheduled restore tests with the results reported to you. If you cannot say with certainty that your business would be back within a day of losing everything, get in touch and we will review what you have, no drama, just a straight answer.