Guide · Security
Backup strategy for small businesses: the 3-2-1 rule and beyond
Hardware fails, people delete things by mistake, updates go wrong and ransomware encrypts everything it can reach. A backup strategy decides whether any of these is an inconvenience or a disaster. The widely used 3-2-1 rule gives a simple structure; a few additions make it robust against today's threats.
[ 01 ]
In short
In short
- 01
3-2-1: at least three copies of data, on two different types of storage, with one copy off-site.
- 02
Add at least one immutable or offline copy that cannot be deleted or encrypted by an attacker with your credentials.
- 03
Back up everything needed to recover: databases, files, configuration, and a way to access secrets.
- 04
Match frequency to how much data loss you can accept; match retention to how late problems may be discovered.
- 05
Test restores regularly — an untested backup is only a hope.
[ 02 ]
Guide
The 3-2-1 rule
- Three copies: the live data plus two backups.
- Two types of storage: for example, the server's disk and cloud object storage — so one failure mode does not destroy both.
- One off-site: in a different location and ideally a different provider or account.
Beyond 3-2-1
Ransomware and account compromise target backups too. Add:
- Immutable copies: storage with write-once or retention locks, so backups cannot be changed or deleted for a set period.
- Separate credentials: backup storage accessed with different accounts from production, with two-factor authentication.
- Offline copies for critical data, where practical.
What to back up
- Databases: customers, orders, content, users.
- Uploaded files and documents.
- Application code (usually in a repository) and server configuration.
- DNS records and critical settings, documented.
- Secrets and keys, stored securely in a separate vault with access procedures.
- Business data outside the website: email, shared documents, accounting — with their own backup plans.
Frequency and retention
- Frequency follows how much data you can afford to lose. A store taking orders all day may need frequent database backups or continuous replication; a rarely updated site can be backed up daily.
- Retention follows how long problems can go unnoticed. Keep daily copies for a few weeks and monthly copies for longer, adjusted for legal retention and personal data rules.
Testing restores
On a schedule, restore a backup into a separate environment and check:
- the data is complete and recent;
- the application runs;
- the time taken matches your recovery objectives.
Document the procedure, so someone other than the original engineer can follow it.
Monitoring
Every backup job reports success or failure. Alerts go to a responsible person if a backup fails, is missing or is abnormally small. See 24/7 monitoring.
After an incident
If backups are needed after an attack, make sure the restored system does not reintroduce the vulnerability or malicious code, and change credentials. See website hacked: what to do.
[ 03 ]
FAQ
Frequently asked questions
Is our hosting provider's backup enough?
It is one layer. An independent copy with a different provider or account protects against provider incidents and account compromise.
How long should backups be kept?
Long enough to recover from late-discovered problems — commonly weeks for daily copies and months for monthly ones — within data protection and legal limits.
How often should restores be tested?
Regularly — for example, quarterly — and after significant changes to the system or backup setup.