Keep three copies of your data, on two different kinds of storage, with one copy somewhere else. That is the whole 3-2-1 rule.
It has lasted because it plans for ordinary failures: a dead disk, a deleted folder, a burst pipe, a stolen password. It is also easy to misread. This article explains each number, the setups that look compliant but are not, and a short check you can run on your own office this week.
What each number means
Three copies. Your live data counts as one. So three copies means the original plus two backups.
One backup protects you from one failure. Two backups cover the day the first backup turns out to be broken too, which is exactly the day you find out.
Two kinds of storage. The copies should not share a weakness. A server disk and a USB drive plugged into that server share a power supply, a room and an admin password. A server disk and an encrypted object store in another region share very little.
“Kind” is less about the hardware and more about what could take out both copies at once. If one event, one person or one password can destroy two copies, they count as one.
One copy off site. At least one copy lives where a fire, flood, theft or power failure in your building cannot reach it. For most small businesses that now means a cloud copy in a different region, not a drive in the owner’s car.
What is not a copy
Most setups that fail the rule fail it here. These things are useful, but none of them is a separate copy:
- RAID. Mirrored disks protect against one disk failing. Delete a file and RAID deletes it on both disks at the same moment.
- Snapshots on the same device. A NAS snapshot is a handy undo button. If the NAS dies or is encrypted, its snapshots go with it.
- Sync folders. Sync makes every device match the newest state, including deletions and encrypted files. See why backup and sync are not the same.
- The recycle bin. It holds deleted items for a while, then empties on its own schedule.
- A second drive that is always plugged in. Anything that can reach your live files can usually reach that drive too.
The test is simple. Ask: if this one machine, room or password were gone tomorrow, would this copy still be there? If the answer is no, it is not one of your three.
Why one copy should be locked
The rule was written before ransomware became a daily concern for small offices. Today the off-site copy has a second job: it must survive someone holding your admin password.
CISA’s #StopRansomware Guide warns that “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.” The same guide tells organizations to “maintain offline, encrypted backups of critical data.”
For a small office, that usually means one of two things:
- A disconnected drive, rotated by hand and stored away from the building. Strong protection, but only as fresh as the last swap, and only as reliable as the person who remembers to do it.
- An immutable cloud copy: storage that refuses to change or delete a backup until a lock date passes, whoever asks. It runs every night without anyone remembering anything.
Some engineers extend the rule to 3-2-1-1-0. The extra 1 is a locked or offline copy. The 0 means zero errors when you test a restore. It is a sensible extension, and immutable backups, explained without jargon covers how the lock works.
3-2-1 in a small office
Here is a common layout for an office with laptops, one server and Microsoft 365:
| Copy | Where it lives | What it covers |
|---|---|---|
| Live data | Laptops, the server, Microsoft 365 | Nothing; this is what is being protected |
| Primary backup | Encrypted storage in a US region | Deleted files, failed disks, bad updates |
| Locked backup | A second US region, at least 500 miles away | Ransomware, stolen admin passwords, regional outages |
Two kinds of storage: the live systems and the cloud object store. Off site: both backups, with the locked one far enough away that one storm cannot reach both.
A careful reader will point out that both backups sit with one provider. That is a fair point. Separate regions, separate credentials and a lock that the provider’s own staff cannot lift reduce that shared risk a great deal. They do not remove it, which is why some offices also keep a local copy.
A local copy on a NAS is worth having if you work with large files. It restores far faster, because nothing has to come down over the internet. It does not replace the off-site copies, for the reasons in a NAS on the shelf is not a backup.
This is roughly how our automated system backup service is laid out. Workstations copy file changes every hour while online. Servers get a nightly image plus hourly file versions. Every copy is encrypted with AES-256 at rest and TLS in transit, and the second copy is locked for 30 days by default.
If you already run a NAS or local backup and only need the far-away locked copy, the Immutable Offsite Copy plan adds that on its own, from $15 per TB per month (indicative).
Example: a basement server room flood
Take a 14-person title company that keeps its server and a NAS in a basement storage room. The NAS takes a nightly backup of the server and keeps snapshots. On paper, that is two copies plus history.
A water heater fails on a Sunday night. By Monday morning the room has standing water, and both boxes sat on the bottom shelf. The live data, the backup and the snapshots were all in one place, so in practice the office had one copy.
Now run the same Sunday with a third copy off site. The job on Monday is ordinary, if tiring: order a replacement server, restore the last nightly image to it, and replay the file versions on top. Staff work from laptops and cloud mail in the meantime. The work lost is measured in hours, not in years of closing files.
The fix was not expensive. It was one more copy, in the right place.
A short 3-2-1 check
Run this on your own office. Write the answers down; the gaps become your next steps.
- List every place work lives: laptops, servers, NAS boxes, Microsoft 365 or Google Workspace, and any line-of-business app.
- For each one, count the copies. The live data is copy one.
- For each copy, write down the room, the building and the account that can delete it.
- Cross out any copy that shares a room or an admin password with the live data.
- Check that at least one remaining copy is off site and cannot be changed or deleted for a set period.
- Find the date of the newest successful copy for each system. Not the last attempt; the last success.
- Pick one file from last month and restore it to a different folder. Time it, and open it.
- Ask who is told when a backup fails, and when they last read one of those alerts.
If every system still has two copies after step 4, and the restore in step 7 worked, you meet the rule. Our 3-2-1 backup checklist goes further, with 12 points in three groups.
Where the rule stops
3-2-1 tells you where copies should live. It says nothing about three other things a backup plan needs:
- How often to copy. A perfect layout with weekly backups still costs you a week of work. Frequency should follow how much work each system can lose; see how often a small business should back up.
- How long to keep versions. If a file was quietly corrupted in March and noticed in June, you need a version from February.
- Whether a restore works. Copies that have never been restored are a hope. A scheduled, timed restore test turns them into a known quantity.
So treat 3-2-1 as the floor, not the finish. Add a schedule, a retention period and a regular test, and you have a backup plan rather than a set of copies.
Check your own setup
If you are not sure how your office scores, the free backup check is a reasonable next step. It takes 45 minutes, remotely: we look at what is copied today, run one test restore with you, and send a written page of findings that you keep either way. Book a free backup check whenever it suits you.
