Most small companies do have a backup. Ask where it is and you hear "on the external drive", "in the cloud" or "the accountant copies everything on Fridays". Ask when anyone last restored a file from it and the room goes quiet.
Until you have restored something from a backup, you don't know whether it works.
The rule in one line
The 3-2-1 rule was first described by the photographer Peter Krogh in 2005, and it is now the standard advice, including from CISA, the US cybersecurity agency, in its guide to backup options:
- 3 copies of your data: the original and two backups.
- 2 different kinds of storage, so a single failure can't take both backups.
- 1 copy kept away from the office.
Each number covers a different way of losing data. Three copies, because one backup that fails quietly leaves you with nothing. Two kinds of storage, because two copies on the same kind of device share the same weak points. One copy elsewhere, because a fire, a burst pipe or a break-in takes everything that sits in the same room, backups included.
What it looks like in a team of five to twenty
You don't need a server room. A setup that follows the rule can be this simple:
- The original: files on the computers and the shared drive, the accounting database, the mailboxes.
- Backup one: a network drive (NAS) or an external disk in the office, filled automatically every night.
- Backup two: a cloud backup service, which also counts as the copy outside the office.
One distinction catches a lot of people out: a synced folder is not a backup. If a file is deleted, overwritten or encrypted in a folder that syncs, the damage syncs to every device within minutes. A backup keeps older versions, so you can go back to last Tuesday.
What goes into the backup
Start from the question "what would stop us working if it vanished today?" For most small firms the list looks like this:
- the accounting database and its exports
- the shared drive and the documents that live only on someone's laptop
- the mailboxes, including shared addresses
- the website and its database (ask your host how often they back it up, and where)
- data kept in online services, such as the CRM or the online shop: check that you can export it, then do it on a schedule
Ransomware changes one detail
Ransomware doesn't stop at the files people work with. It looks for backups it can reach and encrypts or deletes those too. That is why CISA's ransomware guide recommends keeping backups offline and encrypted, and testing them regularly.
An external drive that stays plugged in all the time is not offline. Two practical ways around it:
- Two external drives used in turns: one is connected for the nightly copy, the other is disconnected and kept somewhere else. Swap them every week.
- A cloud backup with version history that the office computers cannot delete or overwrite, even with an administrator password.
The step most firms skip: the restore test
Our suggestion: once a quarter, put an hour in the calendar and try three things:
- Restore one file from last week.
- Restore a whole folder to a different place.
- Restore the accounting database onto a spare computer and open it.
Write down how long each one took. If the answer is "we couldn't find it" or "it needs a password nobody has", you have learned it on a quiet afternoon and not on the day after a disk failure.
Write the restore steps down: where the backups are, who has the password, and what to do first. Keep that note outside the backup itself, or it disappears together with everything else.
A checklist to keep
- Three copies, two kinds of storage, one outside the office.
- At least one copy offline, or one the office computers cannot change.
- Backups run on their own, and someone gets an alert when one fails.
- A restore test every quarter, with the time written down.
- Written restore steps, kept outside the backup.
Setting this up, watching the alerts and running the restore tests is part of our maintenance and support service. If you would like us to look at how your company backs up today, write to us.