The 3-2-1 backup rule, made simple
Three copies, on two different types of storage, one of them off-site. The rule that turns ransomware into a mere nuisance.
When ransomware hits a small business, the first question isn't "How did it get in?" It's "Do we have a clean backup?" The answer decides whether it's a bad day or a disaster.
The rule at a glance
| Number | Meaning | Example |
|---|---|---|
| 3 | Three copies of your data | The original + two backups |
| 2 | On two different types of storage | Computer drive + external drive or NAS |
| 1 | One copy off-site | A cloud service, or a drive kept somewhere else |
Why does the off-site copy matter?
Modern ransomware doesn't just encrypt the computer. It looks for every connected drive and every shared network folder and encrypts those too. If your backup is always connected, it's at as much risk as the original.
That's why the most important copy is the one the infected computer can't reach: a drive that's disconnected after each backup, or a cloud service that keeps previous versions of your files.
A backup you've never tried to restore isn't a backup. It's a hope.
A simple schedule for a small business
- Daily: automatic backup of important files to the network drive.
- Weekly: a copy on an external drive that's disconnected and stored somewhere else.
- Monthly: a test restore of a random file from each backup.
- List the data your business can't keep running without.
- Identify where the three copies of each one live.
- Try restoring one file from your backup today.