Ask a small office "do you have a backup?" and the answer is usually "yes, it's on the external drive." Then the drive fails, gets stolen, or gets encrypted by ransomware along with everything else plugged into the same PC.
The fix is an old, simple rule that still works: 3-2-1.
The rule
Backblaze, a backup company, puts it in one line: keep three copies of your data, on two different types of storage, with one copy off-site.
- 3 copies: the original files, plus two backups.
- 2 types of storage: for example a NAS (a small network storage box) in the office and a cloud service. Not two folders on the same disk.
- 1 off-site: if there is a fire, a flood or a theft in the office, one copy is somewhere else.
The modern version: 3-2-1-1-0
Ransomware changed the game, because it looks for backups and encrypts them too. Veeam's best-practice guide adds two numbers:
- 1 copy offline, air-gapped or immutable. "Immutable" means that once a backup is written, nothing can change or delete it for a set time, not even an admin account that has been hacked.
- 0 errors. You check that backups can really be restored, regularly.
The US cyber agency CISA gives the same advice in its ransomware guide: keep offline, encrypted backups of important data, and test them.
What 3-2-1 looks like in a real small office
Say you have 8 PCs, one shared folder, and email on Microsoft 365 or Google Workspace.
- Copy 1, the original: files on PCs and the shared folder.
- Copy 2, local: every night, PCs and the shared folder back up to a NAS in the office. Restores are fast because the data is right there.
- Copy 3, cloud: the NAS sends its backup to a cloud storage service, with versioning or immutability turned on.
- Email and cloud drives: back up Microsoft 365 or Google Workspace with a separate tool. If someone deletes a folder, or ransomware encrypts a synced drive, the change syncs everywhere. A backup outside the service keeps older versions.
Five questions to check your setup today
- If this PC died right now, what would you lose?
- When did someone last restore a file from backup, not just look at the backup log?
- Is any backup copy outside the building?
- Could a hacked admin account delete all your backups?
- Who gets an alert when a backup fails?
If any answer is "I don't know", that is the place to start.
Common mistakes
- One external drive, always plugged in. Ransomware treats it like any other drive.
- Sync is not backup. OneDrive, Google Drive and Dropbox copy your mistakes too.
- Backups that were never tested. A backup you cannot restore is not a backup.
- Keeping only a few days of history. Some ransomware waits weeks before it shows itself.
How often to test
- Restore one random file every month.
- Restore a whole PC or the shared folder to a test location twice a year.
- Write down how long it took. That is how long your office would be stopped.
In short: three copies, two kinds of storage, one away from the office, one that cannot be changed, and restores you have actually tested. That is the difference between a bad day and losing the business.
Not sure your backups would survive a bad day? Book a free 30-minute consultation and we will go through your setup together. Want the next guide in your inbox? Use the newsletter box below.
Sources: Backblaze: the 3-2-1 backup strategy · Veeam best practices: 3-2-1-1-0 · CISA Ransomware Guide. Checked 11 October 2026.