The 3-2-1 Backup Strategy for Small Businesses

The 3-2-1 backup strategy is the gold standard for data protection and is required or recommended by every major compliance framework and cyber insurance carrier: 3 copies of your data — The original plus two backup copies. This protects against any single point of failure destroying your data. 2 different media types — Store backups on at least two different types of storage (e.g., local NAS/server + cloud storage, or local disk + tape). Different media types protect against media-specific failures. 1 offsite copy — At least one backup must be stored offsite (cloud storage, a remote datacenter, or physically transported media). This protects against site-level disasters: fire, flood, theft, or ransomware that spreads across your local network. Modern update — 3-2-1-1-0: The updated version adds 1 immutable (unchangeable) copy and 0 errors in backup verification testing. Immutable backups are the critical addition for ransomware resilience.

Modern ransomware specifically targets backups. Attackers know that if they can encrypt or delete your backups, you have no choice but to pay the ransom. This is why immutable backups are now essential. Immutable backups cannot be modified, encrypted, or deleted — even by administrators — for a defined retention period. Once written, the data is locked. Implementation options: - Cloud storage with object lock (AWS S3 Object Lock, Azure Immutable Blob Storage, Wasabi Object Lock) - Backup solutions with immutability (Veeam with hardened repository, Datto, Acronis) - Air-gapped backups (physically disconnected storage that ransomware cannot reach) Key principles for ransomware resilience: 1. At least one backup copy must be immutable or air-gapped 2. Backup credentials must be separate from your primary domain (if Active Directory is compromised, backup access shouldn't be) 3. Backup admin accounts should have MFA and be separate from daily-use accounts 4. Monitor backup jobs — ransomware sometimes corrupts backups silently over weeks before deploying encryption Cyber insurance carriers increasingly ask specifically about immutable or air-gapped backups. Having them can positively impact your premium and coverage terms.

A backup you've never tested is a backup you can't trust. Regularly test your backups to ensure they actually work when you need them: Monthly: Verify backup job completion and check for errors. Review backup logs. Confirm all critical systems and data are being backed up. Quarterly: Perform a test restore of individual files and folders. Verify data integrity by opening restored files. Time the restoration process. Annually: Perform a full disaster recovery test. Restore an entire system or server from backup. Document recovery time (RTO) and verify it meets your business requirements. Test your documented recovery procedures. What to back up (at minimum): - All business-critical data (client files, financial records, email) - System configurations and application settings - Active Directory / identity provider configuration - Security tool configurations and policies - Compliance documentation and evidence Document your backup schedule, retention periods, responsible personnel, and test results. This documentation is required by most compliance frameworks and cyber insurance carriers.