The 3-2-1 Backup Rule Explained Simply for Small Businesses

Why backups matter more than you think

Imagine walking into your Braintree office on a Monday morning and finding that your main server won't turn on, your accounting files are gone, and nobody can access customer records. It happens more often than people expect — a failed hard drive, a spilled coffee, a flood in the basement, a stolen laptop, or ransomware (malicious software that locks your files until you pay).

The good news: almost every one of these disasters is survivable if you have good backups. The bad news: many small businesses think they're backed up when they really aren't.

There's a simple, time-tested framework that IT professionals use to get backups right. It's called the 3-2-1 rule, and you don't need to be technical to understand it.

The 3-2-1 rule in plain English

The rule says you should keep:

• 3 copies of your important data
• On 2 different types of storage
• With 1 copy kept offsite (somewhere other than your office)

That's it. Let's break down each part.

3 copies of your data

The first copy is simply the live data you use every day — the files on your computers and server. The other two are backups.

Why three? Because backups can fail too. If your only backup is corrupted or also gets infected, you're out of luck. Having two separate backups means that if one fails, you still have another.

Example: Your customer database lives on your office server (copy 1). It's copied every night to an external drive (copy 2) and also to a secure cloud service (copy 3). If the server dies and the external drive is damaged, the cloud copy still saves you.

2 different types of storage

Don't put all your backups on the same kind of device. If you keep two copies on two external hard drives from the same batch, they could fail for the same reason at the same time.

Common storage types include:

• An external hard drive or a NAS (a "network-attached storage" box — basically a dedicated storage device that sits on your network)
• Cloud backup (data stored in a secure data center over the internet)
• A dedicated backup appliance

Mixing types protects you against a single point of failure.

1 copy offsite

This is the part most small businesses skip — and it's the most important.

If all your backups are sitting in the same office as your computers, then a fire, flood, burst pipe, or theft can wipe out everything at once. We've seen plenty of South Shore basements take on water during a bad nor'easter, and an office flood doesn't care whether a drive is labeled "backup."

An offsite copy lives somewhere else entirely. For most businesses today, that means a reputable cloud backup service. You could also rotate a drive to a second location, but cloud is usually simpler and more reliable.

A realistic example for a 15-person company

Say you run a small firm in Quincy with a server for shared files and Microsoft 365 for email and documents. A solid 3-2-1 setup might look like this:

• Copy 1: Your working files on the server and the files in Microsoft 365.
• Copy 2: A nightly backup to a NAS or backup appliance in your office closet.
• Copy 3: An encrypted cloud backup that runs automatically every night and is stored offsite.

Notice that this covers two storage types (local device + cloud) and keeps one copy offsite. Simple, but it checks every box.

A note about Microsoft 365 and Google Workspace

Many owners assume that because their email and files are "in the cloud," they're automatically backed up. Not quite. Microsoft and Google keep your service running, but they generally don't guarantee long-term recovery if a file is accidentally deleted, overwritten, or encrypted by ransomware — especially beyond a short retention window.

That's why a separate backup of your Microsoft 365 or Google Workspace data is strongly recommended. It's an affordable add-on and closes a gap most businesses don't realize they have.

The step most people forget: testing

A backup you've never tested is just a hope. The only way to know your backups work is to actually restore from them.

At least a few times a year, do a test restore:

1. Pick a file or folder and restore it to confirm it comes back correctly.
2. Occasionally test restoring something larger, like a full folder or a system image.
3. Confirm how long a full recovery would take — an hour, a day, a weekend?

That last point matters. If restoring your entire server takes three days, that's three days your business can't operate. Knowing this in advance lets you plan.

Your 3-2-1 backup checklist

Use this to gauge where you stand:

• [ ] I know exactly what data is critical to my business (files, databases, email, accounting).
• [ ] I have at least three copies of that data.
• [ ] My backups live on at least two different types of storage.
• [ ] At least one copy is stored offsite, away from my office.
• [ ] Backups run automatically, not when someone remembers.
• [ ] My Microsoft 365 or Google Workspace data is backed up separately.
• [ ] Backups are encrypted so stolen data can't be read.
• [ ] I test a restore at least a few times a year.
• [ ] I know how long a full recovery would take.
• [ ] Someone gets alerted if a backup fails.

If you checked every box, you're in excellent shape. If you missed a few, those are your weak points.

Common mistakes to avoid

• Relying on one external drive on a desk. It can fail, be stolen, or get ransomware right alongside your computer.
• Manual backups. If a person has to remember, it eventually won't happen.
• Never checking the backup status. Backups silently stop working all the time. Without alerts, you won't know until you need it.
• Assuming cloud apps are self-protecting. See the Microsoft 365 note above.
• Keeping the only backup in the same room. One disaster shouldn't take out everything.

How this fits into managed IT

Setting up backups correctly isn't complicated once it's in place, but it does require someone to monitor it, verify the data is actually usable, and respond when something fails. For businesses without in-house IT, a managed IT provider typically handles this behind the scenes — automated backups, offsite copies, failure alerts, and periodic test restores — so you don't have to think about it until the day you really need it.

Want a second set of eyes on your backups?

If you're not sure whether your business could recover from a lost server or a ransomware attack tomorrow, we're happy to help you find out. You can book a free 20-minute IT Fit Call with Elecrics at https://elecrics.com/book. We'll talk through your current setup and where the gaps are — no pressure, no jargon.