The 3-2-1 Rule: How to Back Up Business Data Properly
Almost every business backs up its data somehow. The real question isn't whether you back up, but whether you can actually get your data back when it counts.
The 3-2-1 rule is the established minimum standard for backups: three copies of your data, stored on two different types of media, with one copy at a different physical location. Follow this rule and you'll survive the three most common data-loss scenarios: hardware failure, accidental deletion and encryption by malware.
The rule is old, yet it's still broken all the time, usually in the same place: the off-site copy.
What the three numbers mean
Three copies
That means the original data plus two backups. Not two backups of the same state that run to the same disk morning and evening, but two independent copies. The reason is simple probability: a storage device failing is normal. Two failing at the same time is rare.
Two different types of media
For example, one backup on a NAS in the office and one in the cloud. Or a hard drive and a tape drive. The point is that different technologies fail for different reasons. Two identical hard drives from the same batch have an unpleasant habit of giving up at roughly the same time.
One copy off-site
This is where it falls apart in practice. A backup in the same server room as the original doesn't protect against fire, water damage or burglary, and it doesn't protect against ransomware either if the backup device is permanently connected.
The most common mistake in small businesses: an external hard drive that's permanently plugged into the server. If ransomware encrypts the server, it encrypts the drive too. In a ransomware attack, a permanently connected backup is no backup at all.
Why the rule gained a zero
In recent years, an extended version has become established: 3-2-1-1-0. The extra one stands for a copy that's immutable, meaning it can't be overwritten or deleted afterwards, not even by someone with administrator rights. The technical terms are immutable backup or air gap.
The reason is uncomfortably concrete: modern ransomware deliberately hunts for backups and deletes them before it encrypts the actual data. If you want to lock the attacker out, you need a copy that technically can't be deleted.
The zero stands for zero errors when restoring, verified through regular testing. And that's where most backup strategies fall apart in practice.
The test almost nobody runs
A backup that has never been restored is an assumption. Typical problems that only surface during a test:
- The backup job has been failing for months, and the alerts go to an email address nobody reads.
- Only the file shares are backed up, not the database of the inventory system, which lives somewhere else.
- The backup is complete, but restoring it would take four days. For the business, that's a total outage.
- The only person who knows the recovery password left the company a year ago.
A sensible routine: once a quarter, a real restore, at least as a sample. Once a year, a full test with the time measured. Document both in writing; if something goes wrong, that record is worth its weight in gold with insurers and regulators.
Two figures you should define
| Figure | What it means | Example |
|---|---|---|
| RPO (recovery point objective) | How much data loss can you tolerate at most? | 4 hours = a backup at least every 4 hours |
| RTO (recovery time objective) | How long may a restore take? | 8 hours = business must be running again the same day |
These two numbers determine almost everything else: how often you back up, what technology you need and what it all costs. They should come from management, not from IT, because it's a business decision, not a technical one.
What works in practice
A proven setup for a small or mid-sized business:
- Original data on the server or in Microsoft 365.
- Local backup to a NAS in the office, several times a day. Quick to restore after accidental deletion, which is by far the most common case.
- Cloud backup to a German data center, daily, with immutability for a defined period. Covers fire, theft and ransomware.
Important for Microsoft 365 users: Microsoft doesn't back up your data the way many people assume. The company keeps the platform available; it doesn't restore a mailbox that was deleted eight months ago. A separate backup of Exchange, SharePoint and OneDrive isn't a luxury, it's part of the job.
What the law requires
Article 32 of the GDPR explicitly requires the ability "to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident". It also calls for a process for regularly testing the effectiveness of your measures, which is exactly what restore tests are.
For businesses covered by NIS2, backup management is also one of the ten mandatory measures. And the German commercial retention periods of six and ten years apply to digital records just as they do to paper.
Five questions to see where you stand
- Do you know, without checking, whether last night's backup ran?
- Is there an off-site copy that isn't permanently connected to the network?
- When was a restore last tested, and by whom?
- Are Microsoft 365 and your business applications included in the backup?
- Does more than one person know how a restore works?
Five yeses: you're in good shape. Two or more noes: there's work to do, and it should happen before something goes wrong, not after.
Frequently asked questions
What is the 3-2-1 backup rule?
The 3-2-1 rule calls for three copies of your data, stored on two different types of media, with one copy kept at a different physical location. It's the established minimum standard for business backups.
Is an external hard drive enough as a backup?
No. An external drive that's permanently connected to the server gets encrypted along with everything else in a ransomware attack, and it doesn't protect against fire or theft either. You also need an off-site copy, ideally stored so it can't be altered.
How often should you test a backup?
We recommend a sample restore once a quarter and a full, timed test once a year. Document the results, since the GDPR requires the effectiveness of your measures to be checked regularly.
Does Microsoft 365 back up my data automatically?
Not in the sense of a real backup. Microsoft keeps the platform available but doesn't provide long-term recovery of deleted content. Exchange, SharePoint and OneDrive need a backup of their own.
What does 3-2-1-1-0 mean?
An extension of the 3-2-1 rule. The extra one stands for an immutable copy that even administrators can't delete. The zero stands for zero errors when restoring, proven by regular tests.
