The 3-2-1 backup rule, explained for small businesses
Updated 10 November 2026 · How we work
Three copies, two kinds of storage, one away from the office. Why it works, and what it looks like for a typical small business.
Backup sounds complicated, but most good backup plans follow one simple rule that has been around for decades. It is called 3-2-1, and it is a useful way to check whether your business is really protected.
The rule
Keep at least three copies of your important data: the working copy plus two backups. Store them on at least two different kinds of storage, so one type of failure cannot destroy them all. Keep at least one copy away from your office, so a fire, flood or theft does not take everything at once.
Why each part matters
Three copies protects you against the most common problem: a single disk or device failing. Hard drives fail without warning, and we have seen businesses lose years of records because the only backup was on a second drive in the same computer. Two kinds of storage means a problem that affects one type, such as a cloud account being locked or an office network drive being encrypted by ransomware, does not reach the other. One copy offsite covers the disasters nobody plans for.
The modern addition: one copy that cannot be changed
Ransomware deliberately looks for backups to encrypt or delete. So today the advice is to make at least one of the copies immutable, meaning it cannot be altered or deleted for a set period, even by an administrator account, or to keep it completely disconnected. It is one of the first things we look at when we set up or review a backup.
What it looks like in practice
For a typical small business with Microsoft 365 and a few computers, the working data is in Microsoft's cloud, and our daily Wisecom Atlas backup is the separate second copy, stored outside your Microsoft account. For a business with an office server, we usually add a local backup device for quick restores, plus a cloud copy offsite. That way, a deleted folder comes back in minutes from the local copy, and a burned-down office still has everything in the cloud.
Testing is the part people skip
A backup that has never been restored is a hope, not a plan. We test-restore regularly for every client and record the result on the monthly report. If you are not a managed client yet and are not sure your backups would work, our free IT assessment includes a look at them.
Was this helpful?
Related