Small Business Backup Guide: The 3-2-1 Rule and How to Set It Up
Every business owner agrees that backups matter, and most have something they call a backup. The question we ask new clients is different: if your server were encrypted tonight, or the office flooded, or someone deleted the finance folder last Thursday and nobody noticed until today, what exactly would you restore, from where, and how long would it take? The honest answer is often uncomfortable. This guide, which folds together three of our older articles on backups, covers the 3-2-1 rule, what to back up including the data in Microsoft 365, how often, how long to keep it, how to test it, what it costs, and the mistakes that turn a backup into a false sense of security.
Why: the four ways data is lost
- Hardware fails. Every drive, every server, eventually. It is not a question of if.
- People delete and overwrite. Usually by accident, discovered days later, sometimes on purpose by someone leaving.
- Ransomware. Attackers now find and destroy backups before encrypting, which is why the design below assumes a hostile intruder rather than an unlucky disk.
- The building. Fire, flood, storm, theft. In Minnesota, add the ice storm that takes out power for two days.
A backup that survives all four is the goal. Most survive one or two.
The 3-2-1 rule, and the extra 1 and 0
Three copies of your data: the live one and two backups. Two different kinds of storage, so one failure mode does not take both. One copy off site, far enough away that the same fire or flood cannot reach it. The modern additions are one copy that is immutable or offline, meaning it cannot be altered or deleted for a set period even by an administrator, so ransomware cannot destroy it; and zero errors, meaning the backups are verified by actually restoring from them. A typical small business arrangement that meets all of this is a local backup appliance or drive for fast restores, replicated to a cloud service with immutability turned on and its own login, tested monthly.
What to back up
| Data | How | Notes |
|---|---|---|
| Servers and virtual machines | Image-level backup of the whole machine, so it can be restored or spun up elsewhere | Application-consistent for databases; include the domain controller |
| Shared files | Included in the server image, or file-level backup of a NAS | Watch the retention on large libraries |
| Microsoft 365 or Google Workspace | A backup service that copies mailboxes, OneDrive, SharePoint and Teams several times a day | Microsoft and Google do not do this for you; see below |
| Laptops and desktops | Company files redirected to OneDrive so they are in the tenant backup; endpoint backup for the exceptions | Local-only data on a laptop is data you have decided to lose |
| Line-of-business and accounting data | The application’s own backup plus the server image; exports from SaaS applications | Check what the vendor keeps and for how long |
| Configurations | Firewall, switches, phone system, backup settings | Small files that save a day of rebuilding |
| Documentation and credentials | The password manager vault and the sealed break-glass record | Stored where the backup itself cannot be reached |
Microsoft 365 needs its own backup
Microsoft keeps the service running and provides recycle bins and retention windows. It does not promise last Tuesday’s version of a library after ransomware synced through OneDrive, or the mailbox of a departed employee whose account was deleted, or anything past the window. A backup held by a separate provider, with its own credentials, copies the tenant several times a day and lets you restore a file, a folder, a mailbox or everything to a chosen point. Our article on whether cloud data needs backing up goes into the reasons, and the cloud backups page covers the service.
How often, and how long
Two numbers decide this, and they are worth writing down. The recovery point objective is how much work you could stand to redo: a day for many businesses, an hour for a busy accounting or medical practice. The recovery time objective is how long you could be without the system: a day, a few hours, or a business that cannot open. Back up as often as the first number requires, and design the restore to meet the second, which usually means a local copy for speed and the cloud for safety. Keep daily copies for 30 to 60 days, monthly copies for a year and yearly copies for as long as your accountant or regulator requires; ransomware that waited six weeks to act is recovered from the copy made seven weeks ago.
Test it, on a schedule
A backup that has never been restored is a hypothesis. Restore a file every month, a whole server to a test location every quarter, and once a year run the disaster recovery plan as if it were real: bring the business up somewhere else from the off-site copy and see what is missing. Our article on how to know if your backups are good lists what to check, and our disaster recovery plan template is where the annual test belongs. Under a managed plan, the daily report is read by a person and the restore tests are on the calendar.
The mistakes that make backups worthless
- The backup lives on the same server, or on a drive that stays plugged in, and is encrypted with everything else.
- The backup account uses the same administrator credentials as the network, so the attacker who has one has both.
- Sync is mistaken for backup: OneDrive, Dropbox and Google Drive faithfully replicate deletions and ransomware.
- Nobody reads the daily email, so the job that failed in March is discovered in September.
- The only off-site copy is a drive in someone’s car.
- Retention is a week, and the problem is discovered after two.
- Nobody has ever tried a restore, so the first attempt is during the disaster.
What it costs
Cloud backup of servers is priced by the amount of data and the number of machines, and Microsoft 365 backup per user per month; a local appliance adds a one-time cost. The backup pricing calculator gives a monthly figure for your servers and users in about a minute. Against it, weigh the cost of a week without your data, which our cost of downtime article helps estimate, and the fact that tested, immutable backups are now a standard cyber-insurance question. Backups are the control that makes a ransomware attack an outage rather than an extinction event, and they are the cheapest control on the list.
Free tools from OAC Technology
- Cloud backup pricing calculator: a monthly figure for server and Microsoft 365 backups
- Managed services pricing calculator: a monthly figure for managed IT, in about a minute
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
Common questions
Is OneDrive or Google Drive a backup?
No. They are storage that syncs. Delete a file, overwrite it or let ransomware encrypt it and the change syncs faithfully to every copy. Recycle bins and version history help for a while and then expire. A backup is a separate copy, in a separate place, with separate credentials, that you can restore from a chosen point in time.
How often should we back up?
Servers and shared data at least daily, and continuously or hourly for systems where a day of lost work would hurt. Microsoft 365 several times a day, which the backup services do automatically. The right answer comes from asking how much work you could stand to redo; that number is your recovery point objective.
How long should we keep backups?
Daily copies for 30 to 60 days, monthly copies for a year, and yearly copies for as long as regulation or your accountant requires; seven years is common for financial data. Ransomware sometimes sits quietly for weeks before it acts, which is why the older copies matter.
Is an external hard drive enough?
For a one-person business, a rotated pair of drives with one always off site is the minimum. For anyone else, no: a drive that stays connected is encrypted along with everything else, a drive in a desk burns with the building, and nobody checks whether the job ran.
What does business backup cost?
Cloud backup of servers is priced by the amount of data and the number of machines, Microsoft 365 backup per user per month, and both are small next to the cost of a week without your data. Our backup pricing calculator gives a monthly figure in about a minute.
Who should check the backups?
Someone whose job it is, every day, by reading the report and periodically by restoring a file. Under a managed plan that is us. Backups that nobody checks fail silently; the failure is discovered on the day the backup is needed.
Talk to us
If you are not certain what your current backup would actually restore, we will check it, run a test restore, and tell you what it covers and what it does not. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
