The Backup Strategy That Saves You When Everything Goes Wrong

Almost everyone believes they have backups. Far fewer have ever tried restoring from one. The gap between those two states is where data loss actually happens.

This is the rule worth knowing, why each part exists, and how to check that yours works.

The 3-2-1 rule

Three copies of your data. On two different types of storage. One of them somewhere else entirely.

Each number defends against a different failure:

• Three copies covers ordinary failure — the original plus two backups means one backup failing is not a crisis
• Two types of storage covers a whole category failing, whether that is a batch of faulty drives or a service outage
• One copy elsewhere covers everything that takes out a location — fire, flood, burglary, a burst pipe above the server cupboard

A second drive sitting beside the computer satisfies none of these properly. It is better than nothing, and it will not survive the event most likely to destroy the original.

What ransomware changed

The rule predates ransomware, and ransomware exposed a gap in it. Modern attacks look for backups first, because encrypting them is what makes payment feel unavoidable. Any backup your computer can write to freely is a backup an attacker can destroy.

The addition is one copy that cannot be altered or deleted once written — either genuinely offline, or held on a service offering immutable storage for a fixed retention period. Without that, a thorough attack takes your backups with your data.

A setup that works for most small businesses

1. Continuous cloud backup on every machine, running automatically without anyone remembering to do anything
2. A local backup device on the network, for fast restores when someone deletes the wrong folder — which is the everyday case
3. Immutable or offline retention for the copy that survives ransomware
4. A restore test each quarter, written down, with someone's name against it
5. Alerts on failure, because backups fail silently and stay failed for months

The part nearly everyone gets wrong

File sync is not backup. If a service mirrors a folder across your devices, then deleting a file deletes it everywhere, and encrypting your files encrypts them everywhere. Sync is convenience. Backup is a separate copy that does not change when the original does.

Many sync services do offer version history, which helps — but it is usually limited to a window measured in days or weeks, and it is not the same as a retained backup.

Two questions to ask yourself

How much work can you afford to lose — an hour, a day, a week? That sets how often backups need to run. And how long can you afford to be down while restoring? That sets what kind of backup you need, because pulling everything back from the cloud takes considerably longer than restoring from a device in the building.

Answer those two and the right setup becomes fairly obvious. If you would like someone to sanity-check what you have, our IT Division does backup reviews and will tell you honestly if you are already fine.