The 3-2-1-1-0 backup rule, explained for small businesses

The short version

If you meet all five, a single attacker, failed device or bad day shouldn't be able to take every copy of your data away at once, and you'll know your backups work because you've tested them.

Where it came from: the 3-2-1 rule

For years the standard advice was 3-2-1: keep three copies of important data, on two different types of storage, with one copy somewhere else. It protects you against the classic disasters: a disk dies, a server room floods, someone deletes the wrong folder.

It assumes that whatever goes wrong is an accident. Ransomware isn't an accident.

Why ransomware changed the rule

Modern ransomware attackers usually look for your backups before they encrypt anything. If you can restore, you won't pay, so they try to make sure you can't. Common tactics:

• Logging in as an admin with stolen credentials and deleting backup jobs and restore points.
• Encrypting the backup storage itself, especially when it's a network share on the same domain as everything else.
• Shortening retention so older, clean copies quietly expire.
• Waiting. If attackers have been inside longer than your retention period, every copy you hold may already contain their foothold.

Three copies don't help if an attacker with admin rights can reach all three. That's why two numbers were added.

Each number, in practice

3 copies

Your live data plus two backups. Live data counts as one copy, so "we back up the server once" only gets you to two.

2 types of storage

Don't keep every copy on the same kind of device. A backup appliance or server plus cloud object storage is a common pairing. Two folders on the same NAS is still one type of storage, and one failure away from losing both.

1 copy offsite

At least one copy should live in a different building or a different cloud account, so a fire, theft or flood at your office doesn't take everything.

1 copy immutable or offline

This is the number that matters most against ransomware. Immutable means the backup can't be changed or deleted until a set date, even by an administrator. Offline means it's physically or logically disconnected, like a rotated drive kept in a drawer or tape stored offsite.

Common ways small businesses get an immutable copy:

• Cloud object storage with an object-lock feature turned on (most major cloud providers and many S3-compatible services offer it).
• A hardened Linux backup repository that supports immutability, with no remote admin login.
• Rotated removable drives or tape, kept disconnected.

0 errors

A "job completed successfully" message only proves data was copied. It doesn't prove it will restore, or how long a restore takes. Zero errors means you regularly restore real systems, check they work, and fix anything that fails.

What 3-2-1-1-0 can look like on a small budget

An example design for a business with a handful of servers and Microsoft 365. Your details will differ:

Common mistakes we see

• Treating file sync as backup. Sync tools copy deletions and encrypted files too. They're not a backup.
• A USB drive that's always plugged in. If it's connected, ransomware can reach it. Rotate it and disconnect it.
• Using the same admin account everywhere. If the account that runs the network also controls the backups, one stolen password exposes both.
• Assuming the cloud provider backs you up. Microsoft 365 and other SaaS tools keep your data running, but long-term, point-in-time recovery is usually your responsibility.
• Never testing. The most common gap of all, and the cheapest to fix.

Score yourself in two minutes

For your most critical system, answer yes or no: Do you have three copies? On two types of storage? One offsite? One immutable or offline? Have you restored it in the last 90 days?

Most small businesses we speak to answer yes to two or three. Every "no" is a specific, fixable gap.

Next: How to protect your backups from ransomware: 8 practical steps