Backup for small businesses: the 3-2-1 rule

Almost every business we assess has something they call a backup. The question is never whether one exists — it is whether it would survive the event you are backing up against.

The rule, stated plainly

• Three copies of your data — the live one and two backups.
• Two different storage media or systems, so one failure mode cannot take both.
• One copy off site and, critically, offline or immutable.

It is decades old and it survives because each element addresses a different way of losing data: hardware failure, site loss, and deliberate destruction.

Why the offline copy is the whole point

Modern ransomware does not just encrypt the machine it lands on. It looks for backup storage first, because the operators know that a business with working backups will not pay.

Anything mounted and writable from an infected machine is not a backup — it is additional data awaiting encryption. That includes a NAS with a persistent share, a USB drive left plugged in, and cloud storage with a synchronisation client.

The copy that saves you is one the attacker cannot reach: a rotated disk physically disconnected, tape, or object storage with immutability enabled so that even an administrator credential cannot delete it within the retention window.

Where small businesses usually fall short

• One copy, on a NAS, in the same room. Fine against a failed disk. Useless against fire, theft or ransomware.
• A USB drive that stays plugged in. Offline only in intention.
• Microsoft 365 assumed to be backed up. It is not. Microsoft protects the service; your data within it is your responsibility. Retention policies are not backup — a deleted mailbox or an encrypted SharePoint library needs a separate product. This is the most common gap we find.
• Backing up files but not systems. Restoring documents while rebuilding a domain controller by hand is days of work. Image-level backup restores the whole machine.
• Nobody checks the job. Backup software reports failures to an address nobody reads. A backup failing silently for months is the normal case, not the exception.

Retention: how far back can you go?

This matters more than people expect. Ransomware often sits dormant for weeks before triggering. If your retention is seven days and the intrusion happened three weeks ago, every copy you hold may contain the payload.

A reasonable pattern for a small business: daily copies for two weeks, weekly for two months, monthly for a year. The storage cost is modest and the depth is what gives you options.

Testing is the part everyone skips

An untested backup is a belief, not a capability. Two things need testing, and they are different.

Restore test — can you actually get a file back? Do this monthly. It takes ten minutes.

Recovery test — can you bring a whole server back, and how long does it take? Do this annually, on isolated hardware. The purpose is partly to prove it works and partly to find out the real number, because the real number is usually longer than anyone assumed.

That number matters commercially. If restoring your main server takes eleven hours and the business can tolerate four, you have a gap to close — and you would rather learn that during a test than during an incident.

A workable setup

For a typical small office with a server or two:

• Image-level backup to a local NAS, running nightly — fast restores for everyday mistakes.
• Replication from the NAS to cloud or object storage with immutability enabled — the copy ransomware cannot touch.
• A separate backup product covering Microsoft 365.
• Monitoring that alerts a person, not a mailbox nobody opens, when a job fails.
• A monthly restore test with the result written down.

None of this is expensive relative to what it protects. The hard part is not the technology — it is that someone has to own it and keep checking.