The 3-2-1 Backup Rule, Applied to a Small Business

Published October 23, 2026 · Last reviewed October 23, 2026

What each number protects against

The 3 is the live data plus two backups, so that one failed backup does not leave you with nothing. The 2 means the copies fail in different ways: a second disk in the same server does not count, but a cloud repository does. The 1 is an off-site or off-account copy, so a fire, a theft or a compromised administrator does not reach every copy at once.

Many current guides extend the rule to 3-2-1-1-0: one more copy that is immutable or offline (covered in the immutable and offline backups guide), and zero unverified backups (covered in the restore testing guide).

Count your copies honestly

Most small businesses believe they have more copies than they do. Apply these tests to each copy:

• File sync is not backup. OneDrive, Google Drive and similar tools mirror changes, including deletions and encrypted files, to every synced device. A synced folder is one copy, however many laptops hold it. Recycle bins and version history help, but they are time-limited recovery features, not independent backups.
• Same credentials means same copy. If the account that manages your daily work can also delete the backup, an attacker who steals that account can delete both.
• Software-as-a-service data is yours to protect. Providers keep the service running; the shared-responsibility model says customers remain responsible for their own data and access. Retention and recovery windows for mail and files are limited and depend on plan, so read them rather than assume.
• A disk that is always plugged in is online. Ransomware reaches every drive the computer can see.

A short audit you can run today

Action

List what must be backed up and where it lives. Use a plain spreadsheet with one row each for the file server or shared drive, laptops that hold local files, Microsoft 365 or Google Workspace mail and files, the accounting package, the line-of-business database and any phone or tablet data that matters. Add a column for owner.

Why it helps

You cannot protect a data set nobody has written down, and the forgotten ones (a laptop folder, a database on a back-office PC) are the ones lost.

Verification

Every row names an owner and shows the date of the last successful backup, read from the backup tool or the provider's console, not remembered.

Fallback if delayed

If the list is too long to finish, cover finance records and customer data first and add the rest by the end of the month.

Action

Make at least one copy independent of your daily administrator credentials. Give the backup console its own account, protect it with multi-factor authentication, and keep it out of your normal domain or tenant sign-in where the product allows.

Why it helps

Ransomware operators commonly look for and delete accessible backups before they encrypt anything, as CISA notes in its ransomware guide. A copy that a stolen day-to-day login can reach is not a safety net.

Verification

Sign in as your ordinary administrator and try to delete a test backup or change its retention. The attempt should fail or be impossible.

Fallback if delayed

Until this is done, rotate an external disk weekly and keep it unplugged and off the premises between uses.

Action

Add an off-site or off-account copy. This can be a cloud backup repository under separate credentials, or a rotated disk kept at another location.

Why it helps

It covers the events that take out a whole office or a whole account: fire, theft, flood, or a takeover of your main tenant.

Verification

List the contents of the off-site copy from a device that is not on your office network, and confirm last night's job appears with the expected size.

Fallback if delayed

A weekly rotated disk stored at the owner's home or a bank box is better than no off-site copy at all.

Action

Cover your cloud mail and files. In the Microsoft 365 or Google Workspace admin console, read the current retention and deleted-item recovery settings for mail, files and shared drives, and write the number of days down. Decide whether a separate backup is justified for the data that would hurt most to lose. Profile B delta: in Google Workspace the equivalent settings sit in the Admin console, in the data and retention areas, and recovery windows are set by Google and your plan. Menu names change between plans and releases.

Why it helps

Retention is not a backup: it is time-limited, and an attacker with an administrator login can often shorten or bypass it.

Verification

Delete a dummy file and a dummy message, then recover each from the provider's own recovery area, and note how many clicks and how much time it took.

Fallback if delayed

Export key mailboxes and shared folders monthly to the independent copy until a proper backup is in place.

Common failure mode

The typical mistake is counting a second copy that shares a weakness with the first: a network share synced to the cloud, an external drive that stays plugged into the server, or a cloud backup that the same administrator account manages. Each looks like a separate copy on the inventory and fails together in an incident. Test independence by asking what a single stolen login could delete.

How it works

The rule works because it forces diversity: different media, different locations, different credentials. Any single event, whether a failed disk, a deleted folder, a burned building or a hijacked account, has to be able to reach all three copies before you lose the data. The audit above checks that claim for each copy rather than trusting the label on the box.

The extra 1 and 0 in the modern version answer the two ways a backup disappoints in practice: it was erased by an attacker who found it, or it never worked. Immutable or offline storage handles the first, and regular restores handle the second.

Worked example

This is a hypothetical example with invented figures. A 25-person design firm believes it has three copies of its project files: the office file server, a synced cloud folder, and a network drive that backs up the server each night. The audit shows that the cloud folder mirrors the server, the nightly backup drive is permanently connected, and the firm’s administrator account manages all three.

That is effectively one copy that three things can destroy together. The firm adds a cloud backup repository with its own login and multi-factor authentication, moves the nightly drive to a weekly rotation that leaves the building on Fridays, and records the retention window of its cloud mail. Nothing expensive changed; every copy can now be lost without losing the others.