IT Infrastructure
The 3-2-1 Backup Rule: A Simple Plan to Protect Your Business Data
Three copies, two types of storage, one copy off-site. How the 3-2-1 rule protects you from hardware failure, theft and ransomware, and how to put it into practice.
SAG Encoders · · 2 min read
Every business eventually loses data: a laptop is stolen, a hard drive fails, someone deletes the wrong folder, or ransomware encrypts the shared drive. Whether that is an inconvenience or a crisis depends on one thing: whether you have a backup you can actually restore. The 3-2-1 rule is the simplest widely used framework for getting this right.
What 3-2-1 means
- 3 copies of your important data: the original plus two backups.
- 2 different types of storage, for example the office server and a cloud backup service, so one kind of failure cannot destroy everything.
- 1 copy off-site, so fire, flood or theft at the office does not take your backups with it.
Because ransomware often tries to find and encrypt backups too, many organisations extend the rule so that at least one copy is offline or immutable (it cannot be changed or deleted for a set period), and they verify that backups restore without errors. You will sometimes see this written as 3-2-1-1-0.
Sync is not backup
File-sync services are excellent for collaboration, but they copy mistakes as faithfully as they copy good work: delete or encrypt a file on one device and the change can spread everywhere. Some services keep version history for a limited time, which helps, but a real backup is a separate copy, kept on a schedule, that you control and can restore from a point in time.
Decide what to protect, and how quickly you need it back
Start with a list: accounting data, customer records, contracts, email, your website and its database, and the configuration of key systems. For each, agree two numbers:
- Recovery point objective (RPO): how much recent work you could afford to lose. If the answer is "one day", you need at least daily backups.
- Recovery time objective (RTO): how long you could operate without it. A few hours points to a different solution than a few days.
Practical tips
- Automate it. Backups that depend on someone remembering will eventually be missed.
- Encrypt backups, especially off-site copies, and protect the backup account with multi-factor authentication.
- Test restores regularly. Restore a few files every month and a whole system at least once a year.
- Protect against power problems. Where the grid is unreliable, a UPS on servers and storage prevents corruption during sudden outages and gives systems time to shut down cleanly.
- Write down the recovery steps so someone other than your IT person can follow them.
Backups and data protection law
If your backups contain personal data, they are covered by the same rules as the live data. The Nigeria Data Protection Act requires appropriate technical and organisational measures to keep personal data secure, and backups that are encrypted, access-controlled and kept only as long as necessary are part of meeting that duty.