www.simplify-data.de
A failed server, an accidentally deleted folder or a ransomware attack: without a working backup, any of these can bring a small business to a standstill for days. The 3-2-1 rule is a simple rule of thumb for designing backups so that a single event cannot hit every copy at once. This article shows how to apply it in practice.
What the 3-2-1 rule says
The rule can be summed up in three numbers:
- 3 copies of your important data: the original plus two backups
- 2 different storage media, for example a NAS and cloud storage
- 1 copy off-site, meaning outside your business premises
Germany's Federal Office for Information Security (BSI) also describes the 3-2-1 rule as recommended for a successful backup strategy in its guidance on business continuity strategies.
The idea is simple: different media rarely fail at the same time, and an off-site copy survives a fire, water damage or theft at the office.
Why ransomware has extended the rule
Ransomware is malware that encrypts data and demands a ransom. Modern variants actively search for reachable backups and encrypt or delete them too. A NAS that is permanently mapped as a network drive therefore offers little protection.
That is why practitioners often talk about 3-2-1-1-0:
- 1 copy offline or immutable: one backup is disconnected from the network or protected against changes for a defined period. This property is called immutability.
- 0 errors on restore: backups are checked regularly and test restores are performed.
The BSI's ransomware guidance likewise recommends keeping several backup copies separately and practising recovery regularly.
What needs to be backed up
Before buying any hardware, you should know what actually needs protecting. Typical data sources in small businesses include:
- File shares on a server or NAS
- Databases for inventory, accounting or CRM
- Email mailboxes, calendars and contacts
- Cloud services such as Microsoft 365 or Google Workspace
- Websites and online shops, including their databases
- Configurations of firewalls, routers and servers
A common misconception concerns cloud services. Data stored in the cloud is not automatically backed up. Many providers protect against failures of their own infrastructure, but not necessarily against users deleting data by mistake. Check your provider's terms and back up important cloud data separately.
What a practical setup looks like
A typical setup for a company with 10 to 50 workstations could look like this:
| Copy | Location | Medium | Purpose |
|---|---|---|---|
| Original | server, NAS or cloud service | system disks | day-to-day operations |
| Copy 1 | backup NAS at the office | separate device, separate credentials | fast recovery |
| Copy 2 | cloud storage in a data centre | object storage with immutability | protection against fire, theft, ransomware |
As an alternative to the cloud, the off-site copy can be kept on rotating USB drives stored elsewhere. That is inexpensive but requires discipline: someone has to swap and transport the drives regularly.
Important details during setup
- Separate credentials: the backup system should not be reachable with the same admin accounts as your other systems. Otherwise an attacker with one stolen account can delete your backups as well.
- Encryption: off-site copies should be encrypted. Keep the key safe and separate, because without it the backup is worthless.
- Retention: decide how many versions to keep, for example daily backups for two weeks and monthly backups for a year. That lets you go back to a state before an unnoticed infection.
- Data location: cloud backups containing personal data fall under the GDPR. Make sure you have a data processing agreement and know where the data is stored.
Two metrics you should know
Two terms from business continuity planning help with the design:
- RPO (recovery point objective): how much data loss is acceptable at most? If you only back up overnight, you may lose a full day's work in the worst case.
- RTO (recovery time objective): how long may recovery take at most? Downloading a large data set from the cloud can take a long time depending on your internet connection.
These values determine how often you back up and whether a fast local copy is needed.
Common mistakes in practice
Many backup problems only surface when a restore is needed. Typical weak spots are:
- Sync instead of backup: services like OneDrive or Dropbox synchronise files. If a file is deleted or encrypted, that change is synchronised as well.
- Only one copy in the same room: a USB drive next to the server does not help in case of fire or burglary.
- Alerts nobody reads: backups fail for weeks because warnings land in an unused mailbox.
- Incomplete coverage: new systems or file shares are never added to the backup plan.
Checklist for your backup plan
- List data sources: record every system and service whose data you need.
- Set RPO and RTO: define acceptable data loss and maximum downtime for each system.
- Three copies, two media, one off-site: plan storage locations according to the 3-2-1 rule.
- Protect one copy: set up an offline or immutable backup.
- Separate access: use dedicated credentials with multi-factor authentication for the backup system.
- Monitor: get automatic alerts for failed backups.
- Test restores: regularly, for example once a quarter, restore individual files and a complete system as a test.
- Document: write down how a restore works and who is allowed to perform it.
Testing is the step most often skipped. The BSI's IT-Grundschutz module CON.3 also requires regular checks that backups work as intended.
Support from Simplify Data
Simplify Data supports small and mid-sized businesses in Kiel, Schleswig-Holstein and Hamburg as part of our managed services. We help you plan a backup concept that fits your systems and review it regularly. Learn more about our managed services