Guide

The 3-2-1 Backup Strategy, Explained

What the 3-2-1 backup rule means, how to apply it on a small business budget, and the mistakes that quietly turn a backup strategy into a false sense of security.

By SecureBusinessHub Editorial, International cybersecurity desk — · 6 min read

The 3-2-1 backup strategy is a simple rule for how many copies of your data to keep and where to keep them: three copies total, on two different types of storage, with one copy stored somewhere else entirely. It has been standard advice for backups since long before ransomware existed, and it turns out to be almost exactly the right defense against it too. This guide explains what each part of the rule means, how to apply it without a dedicated IT budget, and the mistakes that quietly turn a backup strategy into a false sense of security.

Backups are one half of the recovery story. For what to do once an attack has already happened, read our ransomware survival guide; for stopping an attack before it reaches your files, see our guide to ransomware protection for small businesses. This article is about the groundwork that makes recovery possible at all: having something clean to restore from.

What the numbers actually mean

Three copies means your live, working data plus two backups, not three backups on top of the original. Most businesses already have one of the three without thinking about it: the files sitting on the computer or server people use every day. The rule is about the other two.

  • Three copies: the live data, plus two backups. Losing any one copy still leaves you with a working set.
  • Two different media: not two backups on the same type of drive. A local backup on an external drive and a cloud backup satisfies this; two external drives sitting next to each other does not.
  • One copy offsite: physically or logically separate from your main location, so a fire, theft, or a ransomware infection that spreads across your local network cannot reach all your copies at once.

The point of spreading copies across media and locations is that different failures take out different things. A fire takes out everything in the building. A ransomware infection spreads across whatever it can reach on your network. A single failed hard drive takes out only itself. Three copies, on two kinds of storage, with one somewhere else, means no single bad day gets all of them.

Why ransomware makes this rule non-negotiable

Ransomware does not just encrypt the files on the machine it lands on. Once it has a foothold, it actively looks for anything else it can reach: mapped network drives, connected external storage, and any backup software's own working folders. A backup sitting on a drive that is permanently plugged into an infected computer is not really a backup. It is a second copy of the ransomware's target list.

This is why the offsite copy in 3-2-1 matters so much more than it used to. It is not there for the fire-and-flood scenario people usually picture when they hear "offsite backup." It is there because it is the one copy the ransomware, running on your infected network, cannot reach and encrypt along with everything else.

Doing this on a small budget

A small business can build a working 3-2-1 setup without an in-house server room. A local backup, to an external drive or a small network-attached storage device, covers one of your two media types and is fast to restore from for everyday problems like an accidentally deleted file. A cloud backup service covers the second media type and, done right, doubles as your offsite copy, since it is stored in a data center you do not own and the ransomware on your network cannot reach it directly.

Most cloud backup services aimed at small businesses charge a flat monthly fee per device or per terabyte, and the cost is genuinely small next to what a ransomware payment or a week of downtime costs. If budget is tight, prioritize backing up the data you could not recreate or afford to lose: customer records, financial files, and anything with legal retention requirements. A backup that covers the data that matters, running reliably, beats an ambitious plan to back up everything that never actually gets finished.

The one copy that has to be offline or immutable

"Offsite" alone is not quite enough anymore. Some cloud backup tools are configured to sync continuously, which means if ransomware encrypts your live files, the sync happily uploads the encrypted versions over your good backup. What you actually want for at least one copy is something the ransomware cannot touch even if it has already compromised the account doing the backing up.

There are two practical ways to get this. Immutable backups, a feature offered by most reputable cloud backup providers, lock a backup snapshot so it cannot be altered or deleted for a set period, even by someone with valid credentials to the account. Air-gapped backups take the older, low-tech route: an external drive that is connected only long enough to run the backup, then physically disconnected and stored separately. Either one gives you a copy that is genuinely out of reach of an attacker who is already inside your network, rather than merely inconvenient to reach.

Testing restores, not just backups

The single most common backup mistake is never actually restoring anything until the day you desperately need to. A backup job that runs every night and reports success is not proof the data can be recovered. Corrupted files, an expired license, or a setting quietly changed months ago can all mean a backup that looks fine and restores nothing.

Schedule a real test restore at least twice a year: pick a handful of files or a full system, restore them to a separate location, and confirm they open and work correctly. If you want to test the whole response, not just the backup, our guide to running a ransomware tabletop exercise walks through a scripted scenario that exercises your backups alongside the rest of your incident response plan.

A worked example

A nine-person design studio runs local backups to a network-attached drive every night and a cloud backup once a day, with the cloud provider's immutable snapshot feature turned on for thirty days. When ransomware hits one employee's laptop and spreads to two shared folders on the network drive overnight, the infected network-attached storage backup is affected too, since it was connected and reachable. The cloud backup is not: the ransomware never had valid, working access to it, and the immutable snapshot from the previous day could not have been altered even if it had. The studio restores the affected folders from that snapshot the same afternoon and loses less than a day of work.

Where this fits

A working backup strategy is what makes recovery possible after a ransomware attack, which our ransomware survival guide covers in full, and it belongs alongside a business continuity and disaster recovery plan, which sets out how your business keeps operating while systems are being restored. If you want a structured document to guide your setup and testing schedule, our editable policy template pack includes backup planning guidance built for small businesses.

NIS2 requirements: the second regime to know about

Data protection law is not the only European regime a business gets asked about. The NIS2 directive sets baseline cybersecurity and incident-reporting obligations for organisations in a defined list of sectors, and it is the source of most of the security questions that now arrive attached to contracts. The two regimes cover different ground: data protection law governs personal data and what people can ask you to do with it, while the NIS2 requirements govern the security and resilience of network and information systems, whether or not personal data is involved. A single incident can engage both, on separate clocks, to separate authorities.

The directive applies to organisations in its listed sectors that are at least medium-sized, meaning broadly fifty or more employees or turnover and balance sheet above ten million euros. That size rule puts most small businesses outside its direct scope, and the honest answer for a ten-person company is usually that the directive does not regulate it. What the size rule does not do is keep the requirements away, because one of them is supply chain security: organisations inside scope are expected to consider the security practices of their direct suppliers, and the way that expectation shows up in the world is as a questionnaire in your inbox.

The measures the directive names are a reasonable checklist for any business, which is why they are worth knowing even when they do not apply to you directly. They cover risk analysis and written security policies, incident handling, business continuity and backups, supply chain security, secure development and vulnerability handling, basic cyber hygiene and training including for management, encryption and access control policies, and multi-factor authentication. Reporting is staged and fast for the organisations it covers: an early warning within twenty-four hours of becoming aware of a significant incident, a fuller notification within seventy-two hours, and a final report within one month.

Because the directive is national law in each member state rather than a single rulebook, the details of scope, thresholds and reporting differ by country. For a fuller explanation of the instrument itself, see our guide to what the NIS2 directive is, and for the supplier side of the supply chain obligation, our walkthrough of vendor risk assessment. The reporting clocks that run alongside data protection deadlines are covered in data breach notification requirements.

Frequently asked questions

Does NIS2 apply to a small business?

NIS2 generally applies to organisations in its listed sectors that are at least medium-sized, meaning broadly fifty or more employees or turnover and balance sheet total above ten million euros. Most smaller businesses fall outside its direct scope, unless a member state has specifically designated them or they sit in one of the size-independent categories such as DNS service providers or trust service providers. Being outside scope does not stop the directive reaching you through customers who are inside it.

What is the difference between GDPR and NIS2?

GDPR governs personal data: what you may collect, why you may hold it, and what rights people have over it. NIS2 governs the security and resilience of network and information systems in specific sectors, whether or not personal data is involved. One incident can engage both regimes at once, on separate reporting clocks and to separate authorities.

How long do you have to report a data breach?

Under the European model, a personal data breach is reported to the supervisory authority without undue delay and, where feasible, within seventy-two hours of becoming aware of it, and affected individuals are told without undue delay where the risk to them is high. Organisations in scope of NIS2 carry a separate obligation: an early warning within twenty-four hours, a fuller notification within seventy-two hours, and a final report within one month.

Does a small business need a data protection officer?

Under GDPR a data protection officer is required where the organisation is a public authority, where its core activities involve regular and systematic monitoring of people on a large scale, or where its core activities involve large-scale processing of special category or criminal offence data. Most small businesses meet none of those tests and are not required to appoint one, though naming someone internally as the contact for privacy questions is worth doing regardless.

What should a small business do when a client's security questionnaire asks about NIS2?

Answer what you actually do rather than what you think the client wants to hear. The questions usually cover written security policies, incident handling and how fast you would notify them, multi-factor authentication, access control when staff join and leave, backup and recovery arrangements, and which of your own subprocessors touch their data. Gaps are common, and disclosing one with a date for closing it lands far better than an answer that does not survive the follow-up question.

Do these rules reach a business based outside the EU?

They can. GDPR reaches organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour, and other regions have their own regimes with their own triggers. NIS2 obligations follow the sectors and the member states that transpose it, but its supply chain expectations travel through contracts, which is how they reach suppliers anywhere in the world.

Related reading