In the 3-2-1 rule, the “1” means at least one copy outside the company. Many businesses put this part off because the backup on the office NAS “works.” But any incident that hits the office itself, from fire and flooding to theft or ransomware spreading across the network, destroys the server and the NAS together. An offsite copy means that even on the worst day, you have a starting point for recovery.
Option 1: Rotating disks or tapes by hand
Backups are written to portable disks or tape and periodically moved to another location, such as a branch office or a secure safe. Two or more disks are usually rotated so one is always offsite.
- Pros: Low cost, no need for fast internet, and a fully offline copy out of ransomware’s reach.
- Limitations: Depends on one person’s discipline; the gap between backups is usually long; disks can be lost or stolen, so encryption is mandatory.
Option 2: A branch or second company building
If the company has another branch or warehouse, a NAS or backup server is placed there and backups are copied automatically over the inter-branch link, such as a site-to-site VPN.
- Pros: Automatic, under the company’s own control, and low running cost.
- Limitations: Depends on bandwidth between sites; the second location also needs stable power and physical security; if the two locations are close together, a regional incident may affect both.
Option 3: A backup server or storage in a data center
The offsite copy is kept on a dedicated backup server, a virtual machine or storage space in a data center. Software such as Veeam and Proxmox Backup Server can send a second copy to a remote repository.
- Pros: Professional power, cooling and physical security; immutable storage is possible; with some plans, servers can be brought up in the same data center during a crisis.
- Limitations: Monthly cost, dependence on the office internet connection, and the need to choose a trustworthy provider.
Option 4: Cloud Object Storage
S3-compatible storage offers flexible space for backups, and most backup software supports it. Before choosing, check the reliability of access, where the data is stored, and any contractual and legal requirements for your company’s data.
Always encrypt the offsite copy and keep its key or password somewhere separate from the backup itself and from company servers. A key that is lost along with the server makes the backup useless.
How to choose
- Measure data size and daily change. With incremental backups, usually only changes are transferred, but sending the first full copy may take days; sometimes it is better to move the first copy on a disk.
- Calculate restore time from the offsite copy. Pulling several terabytes back over the internet can be very slow. Can a disk be delivered physically, or can you restore in the same data center?
- Prefer automation. A method that depends on one person’s memory will stop sooner or later.
- Separate access. Accounts with access to the offsite copy should not be the same as the company’s domain accounts.
For many small and mid-sized businesses, a combination works well: an internal NAS for fast restores, an automatic copy in a data center, and a periodic offline disk for critical data. This strikes a good balance between cost and security.
Checklist
- At least one copy of critical data is outside the main building.
- The offsite transfer is automatic, or has a defined schedule and owner.
- The offsite copy is encrypted and its key is stored separately.
- You know the restore time from the offsite copy and have tested it.
- Transfer results are checked every day.
The right choice depends on your data volume, internet connection and budget. With data center and backup services, ITPlus724 engineers can design and set up an offsite backup for your company.