Office Data Backup: The 3-2-1 Rule in Practice
A backup that has never been test-restored is the same as no backup. The 3-2-1 rule gives a simple framework a small office can follow.
The 3-2-1 rule means: keep 3 copies of data (one original and two backups), on 2 different media types, with 1 copy off-site. The aim is that one event, whether a failed disk, ransomware, fire or theft, does not wipe out every copy at once.
What should be backed up?
- Shared working files on the server or NAS.
- Application databases and system configuration.
- Email and important documents on staff laptops.
- The website, including uploads and its database.
- Network device settings and licence keys.
Start with a simple question: which data, if lost, would stop the office working? Back that up first.
What does 3-2-1 look like for a small office?
- Copy 1: working data on the office server or NAS.
- Copy 2: scheduled backup to an external disk or a second NAS in a different room (second medium).
- Copy 3: encrypted backup to cloud storage or another location (off-site copy).
How often, and how long to keep?
Decide two numbers: how many hours of data you can afford to lose (RPO) and how long the system may be down before recovery (RTO). Data that changes daily is usually backed up nightly or more often. Keep several versions (daily, weekly, monthly) so you can return to the state before a file was damaged or encrypted by ransomware.
How do you protect backups from ransomware?
- Keep a copy that is immutable or disconnected from the network.
- Do not map the backup folder as a drive writable from every laptop.
- Use a dedicated backup account with a strong password and two-step verification on cloud services.
- Encrypt backups, and store the key separately from the data.
How do you test recovery?
Schedule a recovery test every three months: pick one file and one system, restore to another location, open it and confirm it is correct. Record how long it took. A written step-by-step procedure matters, because whoever is on duty during an incident is usually under stress.
Common mistakes
- A single external disk always plugged into the same computer.
- Backups exist but nobody knows how to restore them.
- The off-site copy is never checked to see whether it is still running.
- Staff laptop data is not covered at all.
Sentra helps design the backup plan and hardware. See technology consulting, IT procurement and the website security checklist.
Frequently asked questions
Is copying to Google Drive or a sync service a backup?
Not necessarily. Sync services also copy deletions and ransomware-encrypted files. A true backup keeps older versions you can restore.
How much capacity should I plan?
Start from the size of active data, then add room for several versions and growth. Backup capacity is usually several times the active data.
Who is responsible for backups?
Name one person and one deputy. A backup that is everyone's job is usually nobody's.
Is cloud alone enough?
Cloud satisfies the off-site copy. For fast recovery a local copy still helps, because downloading large data from the cloud can take long.
Tell us about the process. We'll help map out the most proportionate approach.
