The 3-2-1 backup rule, for a small business

What the rule says

Keep three copies of anything you cannot afford to lose, on two different kinds of storage, with one of them somewhere else.

The three copies are the original and two backups. It is an old rule, older than cloud storage, and it has lasted because each number protects you from a different kind of bad day.

What each number protects you from

Three copies: because one backup can fail quietly

A backup that stopped running in March looks exactly like one that ran last night, until you need it. With two backups, one failing is an inconvenience rather than the end of the data.

Two kinds of storage: because the same thing fails the same way

Two drives bought together, from the same batch, tend to wear out together. Two copies in the same cloud account disappear together if that account is compromised. Different kinds of storage fail for different reasons, which is the point.

One somewhere else: because some disasters take the whole building

Fire, flood and theft take the server and the drive sitting next to it. So does ransomware, which reaches every machine and drive it can see on your network. A copy kept off-site, and out of reach of your office network, survives all of them.

The newer version: 3-2-1-1-0

Ransomware changed the rule a little. Many IT teams now add two more numbers:

• One copy that cannot be changed or deleted, either because it is disconnected or because it is locked for a set period. Attackers now look for backups and delete them before they encrypt anything else.
• Zero errors when you test a restore. A backup you have never restored from is a hope, not a backup.

What it looks like in a ten-person office

1. The original: files on the office server and on staff laptops.
2. A local copy: a drive in the office that the server backs up to every night. Restoring from it is fast, because nothing has to come down an internet line.
3. An off-site copy: cloud storage, with recent copies locked so that nobody, including an attacker holding your passwords, can delete them for, say, 30 days.
4. A restore test: once a quarter, someone restores a real folder to a different location and opens the files. Write down the date and that it worked.

Mistakes that look like backups

• A USB drive that is always plugged in. Ransomware sees it as just another drive and encrypts it with everything else.
• File sync used as backup. Sync services copy changes everywhere, including deletions and encrypted files. Version history helps, but only for as long as it keeps old versions.
• Backups nobody checks. If failures do not reach a person, the first sign of trouble is the day you need a file.
• Only backing up the server. Laptops hold a surprising amount of work that never reaches the server, especially for staff who travel.

Doing it with Satkosh

Satkosh can write backups to cloud storage, either your own or storage bought from us and kept in India, for the off-site copy, and to a local drive for fast restores. Recent copies can be locked for a period you choose so nothing can delete them. A failed or missed backup sends an email to the people you nominate, and you can restore a folder to a different location at any time to run your test.