The 3-2-1 Backup Rule for Small Businesses (and the Extra Steps Ransomware Demands)

The short answer: keep at least three copies of your data, on two different types of storage, with one copy off site. Because ransomware now goes after backups as well as live data, add one copy that can't be changed or deleted, and zero errors when you test a restore. That extended version is often called 3-2-1-1-0.

What the 3-2-1 rule means

• 3 copies: your live data plus two backups. One backup is a single point of failure; two gives you a fallback when one turns out to be corrupt.
• 2 types of storage: for example a NAS in the office and cloud storage. A fault, firmware bug or mistake that affects one type is unlikely to affect both.
• 1 copy off site: a fire, flood or break-in at the office shouldn't take your backups with it.

Why ransomware changed the rule

Modern ransomware doesn't just encrypt files. Attackers typically look for backup servers, NAS devices and connected drives first, and encrypt or delete them before launching the main attack. If every backup copy is reachable with the same stolen admin password, the attacker can remove your way back.

That's where the extra two numbers come in.

+1: an immutable or offline copy

At least one copy should be impossible to alter or delete for a set period, even by an administrator. There are two common ways to get this:

• Immutable storage: backup copies are locked for a fixed retention period. Many cloud backup services and some NAS systems offer this.
• Offline storage: a copy physically disconnected from the network, such as rotated external drives or tape.

+0: zero errors on a tested restore

A backup you haven't restored from is a hope, not a plan. Test restores regularly: a single file, a full mailbox and, at least once a year, a whole server or system. Record how long each took.

RAID is not a backup

RAID protects against a drive failing. It does nothing about a deleted file, a corrupted database, ransomware or a stolen server, because every change is copied across the drives instantly. Our guide to RAID levels explains what RAID does do.

Two numbers to decide first: RPO and RTO

A nightly backup gives an RPO of up to 24 hours. If that's too much for your accounts system, it needs more frequent backups or snapshots.

A practical 3-2-1-1-0 setup for a small office

1. Copy 1, on site: nightly (or more frequent) backups of servers and PCs to a NAS, with snapshots turned on. See our comparison of a NAS and a server.
2. Copy 2, off site: the NAS or backup software replicates to cloud storage.
3. Immutable: turn on immutability or object lock for the cloud copy, with a retention period of at least 14 to 30 days.
4. Separate credentials: the backup system and cloud account use different admin accounts from your everyday Windows domain, with multi-factor authentication.
5. Cloud apps too: Microsoft 365 email, OneDrive and SharePoint need their own backup. See does Microsoft back up your Microsoft 365 data?
6. Test and record: monthly file restores, quarterly mailbox or VM restores, and an annual full recovery test.

Common gaps

• A USB drive that's permanently plugged into the server, so ransomware encrypts it too.
• Backups that report "success" but have silently skipped open files or databases.
• Laptops that are never backed up because the data "is on OneDrive" (it may not all be).
• No one knowing the password to the cloud backup account.
• Retention so short that a problem noticed after two weeks can't be undone.

How Apaxon can help

Apaxon designs and checks backup set-ups as part of its managed IT services and managed cloud services, and supplies QNAP NAS units and business storage from the Apaxon store. For larger shared storage, see our storage solutions. If you'd like a second opinion on your current backups, get in touch.