Backup basics: the 3-2-1 rule explained for small business

"We're backed up" — are you, though?

We hear it every week. Then we ask: when did you last restore a file? Where does the backup live? What happens if the office floods, or ransomware encrypts the NAS that's also the backup target?

Backing up isn't copying files to a USB drive in a drawer. A usable backup strategy answers three questions: what gets backed up, how often, and can you actually restore it in time to matter.

The 3-2-1 rule in plain English

• 3 copies of important data
• 2 different types of storage (e.g. on-server + cloud)
• 1 copy off-site and offline from production

For a ten-person office that might mean: files on the server, replicated to cloud backup nightly, and Microsoft 365 retention for email. For a workshop with CAD files, it might include an offline rotation — but cloud with immutable retention is often simpler now.

Tests beat assumptions

Schedule a quarterly restore test. Pick a random file, restore it, open it. Time how long it took. That's your real RTO — recovery time objective — not the number on the sales brochure.

Watch for:

• Backups that silently stopped after a password change
• Drives full to 99% so new jobs fail
• "Backup" that's just OneDrive sync (not protection against ransomware)
• No monitoring — nobody knew it failed until the restore

How we set it up

We combine cloud backup for servers and endpoints with Microsoft 365 retention policies where appropriate, monitor job success daily, and document who restores what when someone's left in a hurry.

If you're not sure when your backups last succeeded, book a review — it's one of the highest-value hours we spend with new clients.