A backup can fail quietly for weeks. These 12 checks find that out early. Work through them with whoever runs your backups and mark each one yes or no.
The 3-2-1 rule, in three lines
Every check below comes back to this.
Three copies
Your live data plus two backups, so one failed copy never leaves you with nothing.
Two kinds of storage
Keep the copies on different kinds of storage, such as a local NAS and cloud storage, so one fault cannot reach both.
One copy off site
Keep one copy far from the office, in another region, and lock it so nobody can change or delete it.
Copies and places
Checks 1 to 4: what is copied, and where it goes.
Everything is listed
Every server, laptop, NAS share and cloud account is on one list, with an owner beside it.
Each item is scheduled
Every item on that list has a scheduled backup. None depends on someone remembering.
One copy far away
One copy sits in a different region, far enough that one storm or flood cannot reach both.
One copy locked
One copy is immutable or offline, so a stolen admin password cannot delete it.
Schedules and retention
Checks 5 to 8: how often copies run, and how far back they go.
Schedules fit the work
Busy files copy at least hourly and servers at least nightly, matched to the work you could lose.
Failures reach a person
A named person reads every failed job and gets it fixed the same business day.
Versions reach back
You can restore a file as it was last month, not only as it was last night.
Cloud apps copied
Microsoft 365 or Google Workspace mail and files have a backup outside the provider’s recycle bin.
Testing and people
Checks 9 to 12: proof that it restores, and who can reach it.
A recent restore
Someone restored real files this quarter, opened them, and wrote down how long it took.
A whole system restored
A full server or laptop has been restored from backup and timed, not only single files.
Steps on paper
Restore steps and contacts are written down and reachable when the network is down.
Access kept short
Only named people can sign in to the backups, each with two-factor sign-in.
Backup checklist questions, answered
Is the 3-2-1 rule still enough?
It is a sound floor, with one update: make the off-site copy locked or offline. CISA’s #StopRansomware Guide warns that “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.” A copy nobody can change or delete closes that gap; our Immutable Offsite Copy plan locks it for 30 days by default.
Does a NAS count as one of the copies?
Yes, as one copy on one kind of storage in one building. It is a good fast local copy, but if it is your only backup, a fire, a flood or ransomware on the office network can reach it and the live data together. Read A NAS on the shelf is not a backup.
Does cloud sync count as the off-site copy?
No. Sync copies every change to every device, including deletions and encrypted files, so it fails at the moment you need it. An off-site backup keeps separate versions that sync cannot change. Backup and sync are not the same explains the difference, with examples.
How often should we run through this checklist?
Once a quarter, alongside a test restore, and again after any big change: a new server, a new office, or a change of IT person or provider. If you would rather not run the tests yourself, our Restore Drill plan restores files, one mailbox and one full system every quarter, with a written result.
Check the list with us
A free 45-minute backup check reviews what you copy today, runs one test restore, and gives you a written page of findings.