Guide
The 3-2-1 Backup Strategy, Explained
What the 3-2-1 backup rule means, how to apply it on a small business budget, and the mistakes that quietly turn a backup strategy into a false sense of security.
By SecureBusinessHub Editorial, International cybersecurity desk — · 6 min read
The 3-2-1 backup strategy is a simple rule for how many copies of your data to keep and where to keep them: three copies total, on two different types of storage, with one copy stored somewhere else entirely. It has been standard advice for backups since long before ransomware existed, and it turns out to be almost exactly the right defense against it too. This guide explains what each part of the rule means, how to apply it without a dedicated IT budget, and the mistakes that quietly turn a backup strategy into a false sense of security.
Backups are one half of the recovery story. For what to do once an attack has already happened, read our ransomware survival guide; for stopping an attack before it reaches your files, see our guide to ransomware protection for small businesses. This article is about the groundwork that makes recovery possible at all: having something clean to restore from.
What the numbers actually mean
Three copies means your live, working data plus two backups, not three backups on top of the original. Most businesses already have one of the three without thinking about it: the files sitting on the computer or server people use every day. The rule is about the other two.
- Three copies: the live data, plus two backups. Losing any one copy still leaves you with a working set.
- Two different media: not two backups on the same type of drive. A local backup on an external drive and a cloud backup satisfies this; two external drives sitting next to each other does not.
- One copy offsite: physically or logically separate from your main location, so a fire, theft, or a ransomware infection that spreads across your local network cannot reach all your copies at once.
The point of spreading copies across media and locations is that different failures take out different things. A fire takes out everything in the building. A ransomware infection spreads across whatever it can reach on your network. A single failed hard drive takes out only itself. Three copies, on two kinds of storage, with one somewhere else, means no single bad day gets all of them.
Why ransomware makes this rule non-negotiable
Ransomware does not just encrypt the files on the machine it lands on. Once it has a foothold, it actively looks for anything else it can reach: mapped network drives, connected external storage, and any backup software's own working folders. A backup sitting on a drive that is permanently plugged into an infected computer is not really a backup. It is a second copy of the ransomware's target list.
This is why the offsite copy in 3-2-1 matters so much more than it used to. It is not there for the fire-and-flood scenario people usually picture when they hear "offsite backup." It is there because it is the one copy the ransomware, running on your infected network, cannot reach and encrypt along with everything else.
Doing this on a small budget
A small business can build a working 3-2-1 setup without an in-house server room. A local backup, to an external drive or a small network-attached storage device, covers one of your two media types and is fast to restore from for everyday problems like an accidentally deleted file. A cloud backup service covers the second media type and, done right, doubles as your offsite copy, since it is stored in a data center you do not own and the ransomware on your network cannot reach it directly.
Most cloud backup services aimed at small businesses charge a flat monthly fee per device or per terabyte, and the cost is genuinely small next to what a ransomware payment or a week of downtime costs. If budget is tight, prioritize backing up the data you could not recreate or afford to lose: customer records, financial files, and anything with legal retention requirements. A backup that covers the data that matters, running reliably, beats an ambitious plan to back up everything that never actually gets finished.
The one copy that has to be offline or immutable
"Offsite" alone is not quite enough anymore. Some cloud backup tools are configured to sync continuously, which means if ransomware encrypts your live files, the sync happily uploads the encrypted versions over your good backup. What you actually want for at least one copy is something the ransomware cannot touch even if it has already compromised the account doing the backing up.
There are two practical ways to get this. Immutable backups, a feature offered by most reputable cloud backup providers, lock a backup snapshot so it cannot be altered or deleted for a set period, even by someone with valid credentials to the account. Air-gapped backups take the older, low-tech route: an external drive that is connected only long enough to run the backup, then physically disconnected and stored separately. Either one gives you a copy that is genuinely out of reach of an attacker who is already inside your network, rather than merely inconvenient to reach.
Testing restores, not just backups
The single most common backup mistake is never actually restoring anything until the day you desperately need to. A backup job that runs every night and reports success is not proof the data can be recovered. Corrupted files, an expired license, or a setting quietly changed months ago can all mean a backup that looks fine and restores nothing.
Schedule a real test restore at least twice a year: pick a handful of files or a full system, restore them to a separate location, and confirm they open and work correctly. If you want to test the whole response, not just the backup, our guide to running a ransomware tabletop exercise walks through a scripted scenario that exercises your backups alongside the rest of your incident response plan.
A worked example
A nine-person design studio runs local backups to a network-attached drive every night and a cloud backup once a day, with the cloud provider's immutable snapshot feature turned on for thirty days. When ransomware hits one employee's laptop and spreads to two shared folders on the network drive overnight, the infected network-attached storage backup is affected too, since it was connected and reachable. The cloud backup is not: the ransomware never had valid, working access to it, and the immutable snapshot from the previous day could not have been altered even if it had. The studio restores the affected folders from that snapshot the same afternoon and loses less than a day of work.
Where this fits
A working backup strategy is what makes recovery possible after a ransomware attack, which our ransomware survival guide covers in full, and it belongs alongside a business continuity and disaster recovery plan, which sets out how your business keeps operating while systems are being restored. If you want a structured document to guide your setup and testing schedule, our editable policy template pack includes backup planning guidance built for small businesses.