How to Back Up Business Data: The 3-2-1 Rule and Beyond

Most businesses find out whether their backups work at the worst possible moment: the server won’t boot, a laptop is stolen, an employee deletes the wrong folder or ransomware has encrypted everything. That’s when “I think we back up to something” turns into a very long week.

A good backup plan isn’t complicated, but it has to be deliberate. You need to know what you’re backing up, where the copies live, how quickly you can restore and whether the restore actually works. This guide walks through the 3-2-1 rule recommended by the US Cybersecurity and Infrastructure Security Agency (CISA), the extra protections ransomware now demands, a plan template you can fill in and the testing routine that makes backups trustworthy.

The 3-2-1 rule explained

CISA’s small business guidance recommends the 3-2-1 rule:

• 3 copies of your important data: the original plus 2 backups.
• 2 different types of storage, such as a local hard drive and the cloud.
• 1 copy off-site, away from your business location.

The logic is simple. Different storage types fail in different ways, and an off-site copy survives a fire, flood or theft at your office. A combination of on-site and remote backups protects against cyberattacks, hardware failure and physical damage.

Beyond 3-2-1: protecting backups from ransomware

The 3-2-1 rule was designed for hardware failures and disasters. Ransomware adds a new problem: attackers go looking for your backups. CISA’s #StopRansomware Guide warns that many ransomware variants try to find and delete or encrypt accessible backups, and recommends keeping offline, encrypted backups.

That’s why many IT teams add 2 more principles, sometimes described as 3-2-1-1-0:

• 1 copy offline, air-gapped or immutable. Immutable storage can’t be changed or deleted for a set period, even by an administrator account. Offline means physically disconnected, such as a drive kept unplugged.
• 0 errors on restore tests. You verify that backups actually restore.

Other ransomware protections for backups:

• Separate credentials. Don’t use the same admin account for your network and your backup system. Protect backup consoles with multifactor authentication.
• Encryption. CISA recommends protections for backups including physical security, encryption and offline copies.
• Version history. Keep multiple restore points. CISA suggests confirming you can roll data back at least 7 days, since an infection may go unnoticed for a while.

Key takeaway: A backup that an attacker can reach with stolen admin credentials isn’t a safe backup. Keep at least one copy offline or immutable, protect backup accounts with MFA, and test that you can restore.

What to back up

Start with an inventory. CISA recommends identifying the data your business can’t operate without and prioritizing it. Typical categories include:

• Customer and client records
• Employee and HR information
• Financial, accounting and payroll data
• Email and critical communications
• Configuration files and software settings
• Website files and operational databases

Don’t forget data in cloud apps. Microsoft 365, Google Workspace, accounting platforms and customer relationship management (CRM) systems keep your data available, but deleted or encrypted files may only be recoverable within limited retention windows. Microsoft’s own services agreement advises users to make regular backups of their content. Check each provider’s retention settings and consider a dedicated backup product for your most important cloud apps.

Sync is not backup

File sync services such as OneDrive, Google Drive and Dropbox copy changes instantly across devices. That’s great for collaboration, but it also means a deletion or ransomware encryption can sync everywhere. Version history helps, but it isn’t a full backup plan. Our comparison of iCloud, Google Drive and OneDrive explains how each handles versions.

Choosing backup storage

Here’s how the common options compare for a small business.

A common small-business setup is a local NAS or external drive for fast restores, plus a cloud backup service with immutability or versioning for the off-site copy, plus a SaaS backup for email and cloud files.

Set your recovery targets: RPO and RTO

Before you choose a schedule, answer 2 questions for each system:

• Recovery point objective (RPO): how much data can you afford to lose? If your RPO is 24 hours, nightly backups are fine. If it’s 1 hour, you need hourly backups or continuous replication.
• Recovery time objective (RTO): how long can you be down? NIST defines RTO as the overall time a system’s components can be in recovery before negatively affecting the organization’s mission or business processes.

Your point-of-sale or scheduling system may need an RTO of hours, while archived files can wait days. CISA recommends using recovery tests to refine these targets. For a deeper explanation, read RTO vs RPO.

Your backup plan template

Copy this table into a spreadsheet and fill in one row for each important system or data set.

Store the plan, restore instructions and key contacts somewhere you can reach if your systems are down, including a printed copy.

How to test your backups

CISA recommends testing backup procedures so your team can restore data both fully and partially, and making sure critical files can be accessed without an internet connection. A backup you’ve never restored is an assumption.

Use this testing routine:

1. Monthly: restore a file. Pick a random file from each critical system and restore it to a different location. Open it to confirm it isn’t corrupted.
2. Quarterly: restore a folder or mailbox. Restore a larger set of data and time how long it takes. Compare against your RTO.
3. Twice a year: restore a full system. Rebuild a computer or server from backup onto spare hardware or a virtual machine.
4. Yearly: run a tabletop exercise. Walk your team through a ransomware scenario. Who notices, who decides, who restores and in what order?
5. After every test: write it down. Record the date, what you restored, how long it took and any problems. Fix problems right away.

Check backup reports or alerts weekly, too. Many backup failures happen silently, such as a full disk, an expired password or a computer that stopped checking in.

Where to start this week

1. Inventory your critical data using CISA’s categories above.
2. Check what’s already backed up, including whether your cloud apps have retention or backup settings turned on.
3. Set up an automated off-site backup for every computer and server. CISA recommends choosing a solution that runs automatically and regularly.
4. Add a protected copy that’s offline or immutable.
5. Turn on MFA for backup accounts and encrypt backup data.
6. Run your first restore test and record the result in your plan.

Backups are also one of the first things cyber insurers ask about. See cyber insurance requirements, and add backups to your full small business cybersecurity checklist. For the bigger picture on ransomware defenses, read our ransomware protection guide.

Conclusion

The 3-2-1 rule is still the right foundation: 3 copies, 2 storage types, 1 off-site. Ransomware means you now need more: at least one offline or immutable copy, separate and MFA-protected backup credentials, encryption and enough version history to roll back past an infection. Most important of all, test restores on a schedule and write down the results. When something goes wrong, the businesses that recover quickly are the ones that practiced.

Sources

• CISA: Back Up Business Data — the 3-2-1 rule, what to back up, protections and restore testing
• CISA: #StopRansomware Guide — ransomware targeting of backups and offline encrypted backups
• NIST: Glossary, recovery time objective — RTO definition from SP 800-34 Rev. 1
• NIST: SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems — contingency planning and recovery strategies
• Microsoft Services Agreement — Microsoft’s advice to keep regular backups of your content