The 3-2-1 Backup Rule Explained With a Small Office Plan

Ask anyone who has lost years of photos or a business's client files to a dead drive, a stolen laptop or ransomware, and they will tell you the same thing: they meant to set up backups. The 3-2-1 rule exists to make that intention concrete. It is simple enough to remember and strong enough that professionals still use it as a baseline.

What the 3-2-1 rule means

• 3 copies of your data: the original you work on, plus two backups.
• 2 different kinds of storage: for example, your computer's internal drive and an external drive or network storage device. Different storage types are unlikely to fail in the same way at the same time.
• 1 copy offsite: somewhere physically separate, such as a cloud backup service or a drive kept at another location. This protects you from fire, flood, theft and burst pipes.

The logic is about independent failures. One copy can die. Two copies in the same building can die together. Three copies spread across storage types and locations make total loss very unlikely.

The modern addition: one copy the attacker cannot touch

Ransomware changed backup thinking. If your backup drive is always plugged in, or your cloud backup can be deleted with the same password an attacker stole, the attack can destroy your backups along with your files.

That is why many people now talk about an extra rule: keep at least one copy offline (unplugged and disconnected) or immutable (stored by a service in a way that cannot be changed or deleted for a set period). Some describe this as 3-2-1-1-0: the extra 1 for an offline or immutable copy, and 0 for zero errors when you test restores. Our guide to ransomware for small offices explains why this matters.

Step 1: Decide what needs protecting

Before buying anything, list what you would truly miss. For a small office, that usually includes:

• Documents and shared files.
• Accounting and financial records.
• Email, if it is not already kept by a provider with good retention.
• Customer, member or donor databases.
• Your website's files and database.
• Photos and media you create.
• Your password manager vault.
• Records of important settings: router configuration, domain and DNS details, software license keys.

Also note how much you could stand to lose. If redoing a day's work would be painful but survivable, nightly backups may be fine. If losing an hour of orders would be serious, you need more frequent backups for that system.

Step 2: Build your three copies

Here is a practical setup for a small office or household.

Copy 1, the original. Your files on computers, shared storage or cloud workspaces.

Copy 2, a local backup. An external drive or a small network storage device that backs up automatically, keeping multiple versions so you can go back to last Tuesday's file, not just last night's. Local backups restore quickly.

Copy 3, an offsite backup. A cloud backup service that copies your files on a schedule and keeps version history. Choose one that encrypts data, offers versioning for a period that fits you, and lets you protect backups from deletion. Alternatively, rotate two external drives and keep one at another location, swapping them weekly.

Remember that a file sync service is not the same as a backup. Our guide to cloud sync versus backup explains the difference.

Step 3: Protect the backups themselves

• Encrypt backups, especially anything stored offsite or on portable drives, and store the encryption key or password somewhere safe, separate from the backups.
• Use different credentials for your backup service than for everyday accounts, and turn on two-factor authentication.
• Disconnect rotation drives when they are not in use.
• Limit who can delete backups. Ideally, only one or two trusted people.

Step 4: Assign an owner and a schedule

Backups quietly fail when nobody is watching. Name one person responsible and give them a short routine:

• Weekly: confirm backups ran successfully. Most tools send status emails or show a dashboard.
• Monthly: restore a handful of random files to prove they open.
• Yearly: do a larger recovery test, such as restoring a whole computer or folder set.

Our step-by-step guide to testing a backup restore walks through it.

Do not forget cloud apps and websites

Data in online tools, such as email, accounting software and website platforms, is usually protected against the provider's hardware failures, but not always against your own mistakes, a compromised account or a canceled subscription. Check each tool's export and retention options. Websites need their own approach, covered in our guide to backing up a website.

Frequently asked questions

Is a cloud backup service enough on its own?

It covers the offsite copy, which is the most important one for disasters. Adding a local backup gives you faster restores and an independent copy if your internet or the service has a problem.

How long should we keep old backup versions?

Keep enough history to recover from problems you might not notice right away, such as an accidentally deleted folder or a slow-moving infection. Many small offices keep at least several weeks of versions, with longer retention for financial records as their accountant advises.

Do personal photos need the 3-2-1 rule too?

Yes, especially irreplaceable family photos. A phone's cloud photo service plus a periodic copy to a computer or external drive is a good start.