The 3-2-1 Backup Rule Explained for Small Businesses

The 3-2-1 rule is the simplest test of whether a backup plan is good enough: three copies of your data, on two different devices, with one copy off-site.

What each number means

• 3 copies: the working copy plus two backups. One backup can fail at the moment you need it, so you keep two.
• 2 devices: the backups are not on the same machine as the original. A second folder on the same NAS does not count.
• 1 off-site: one copy is somewhere a fire, a theft or a ransomware attack in the office cannot reach.

What it looks like with a NAS

Computers and servers back up to the NAS every night: that is copy two. The NAS then copies itself to a second NAS at another site, or to cloud storage: that is copy three, and it is off-site.

Snapshots on the NAS add version history on top, so you can go back to yesterday or last month.

Where plans usually fall short

• The only backup is an external drive that sits next to the computer
• The off-site copy is reachable from every PC, so ransomware reaches it too
• Nobody has tried a restore, so nobody knows whether it works
• Backups keep only the latest version, which may already be damaged

The stricter version: 3-2-1-1-0

Many organisations now add two more conditions: one copy that is immutable or offline, and zero errors when the backup is verified. Immutable snapshots and regular restore tests cover both.

Common questions