Ask most managers whether they back up their data and they will say yes. Ask where the backup actually lives, and the answer is usually an external drive sitting next to the server, or a second disk inside the same server. That kind of backup helps if someone deletes a file by mistake. But in a fire, a theft, a power failure or a ransomware attack, it is lost along with the original data.
The 3-2-1 rule exists for exactly this reason: back up in a way that no single event can destroy every copy at once.
The 3-2-1 Rule in Plain Terms
- 3 copies of your data: the original data plus at least two backup copies.
- 2 different types of media: for example, a network storage device (NAS) and a separate disk or tape, so that a failure of one media type does not affect every copy.
- 1 copy off-site: in another building, a data center or the cloud, so that an incident at the office cannot reach it.
Many experts now recommend the extended 3-2-1-1-0 version: one immutable or offline copy, and zero errors in restore testing.
Step 1: Know What You Need to Back Up
Before buying any equipment, write down a list of your critical data. The list usually includes:
- Databases for financial, accounting and inventory software
- The file server and departments’ shared folders
- Virtual machines and core servers, such as domain controllers and email
- Network device and firewall configurations
For each item, answer two questions: How many hours of data can we afford to lose? (this determines how often you back up) and How long can we work without this system? (this determines how fast a restore must be). For example, a financial database may need a backup every few hours, while a daily backup is enough for a document archive.
Step 2: Design Your Copies
A common, cost-effective design for small and midsize businesses looks like this:
- First copy on a NAS inside the network: automatic, scheduled backups of servers and virtual machines. This copy is for fast, everyday restores.
- Second copy on different media: a copy of the same backups on a second disk or storage device, ideally with immutability, so it cannot be deleted for a set period, even with administrator access.
- Third copy off-site: automatic replication to a data center or another branch, or periodic rotation of disks to a secure location.
Step 3: Keep Backups Out of Ransomware’s Reach
Ransomware now goes after backups first. If the backup server can be reached with the same domain accounts, then once attackers get into the network, the backups are encrypted or deleted too. A few simple measures greatly reduce the risk:
- Do not join the backup server or repository to the domain, and give it separate accounts and passwords.
- Use an immutable repository or an offline copy.
- Restrict access to backup storage to the backup software only, not to all users.
Step 4: Test Restores, the Most Forgotten Step
A backup whose restore has never been tested is just a hope. At least every few months, perform a real restore: bring up a virtual machine in an isolated environment, or restore the database to a test server and confirm the software works with it. Record how long the restore takes. That number tells you how long it will take to get back to work on the day of a crisis.
Step 5: Monitor Daily
Many disasters start with a backup that had been silently failing for weeks. Backup job results should be checked every day, and if a backup fails or a database backup file does not arrive, someone should know that same day. This can be automated, and the ITPlus724 early warning system does exactly this for our clients.
Summary Checklist
- You have listed your critical data and the acceptable backup interval for each item.
- You have three copies, on two types of media, with one copy off-site.
- At least one copy is immutable or offline.
- The backup server is separated from the domain and user accounts.
- You have tested a restore in the last few months.
- Backup results are checked every day.
If the answer to any of these is “no,” start there. ITPlus724 engineers can also review your current backup setup and run a test restore for your company.