Backups for small businesses: the 3-2-1 rule

In small businesses, backups are usually forgotten until the day they are needed. Yet a ransomware attack, a failed disk or an accidentally deleted folder can make years of accounting and customer data unavailable in an instant. The good news is that setting up an effective backup routine is not as complicated as it sounds.

What is the 3-2-1 rule?

Recommended by security specialists for years, the rule has three simple parts:

• 3 copies: keep at least three copies of your data, one primary and two backups.
• 2 different media: store backups on two different types of media, for example a network storage device and the cloud.
• 1 copy off site: keep at least one copy physically outside your office.

This routine prevents a single event from destroying every copy at once. If there is a fire in the office, the cloud copy saves you; if you lose access to your cloud account, the office copy does.

Immutable backups against ransomware

Modern ransomware looks for backups on the network and encrypts them too. That is why at least one backup should be immutable: a backup that no one, not even an administrator account, can delete or overwrite for a set period. Many cloud backup services offer this feature.

How often?

Backup frequency is set by how much data you can afford to lose. Ask yourself: "If we had to re-enter everything since the last backup, how long would it take?" For accounting and order data, a daily backup is the minimum for most businesses; those taking a high volume of orders should consider hourly backups.

Test your restores

An untested backup is not a backup. Many businesses only discover that their backups are incomplete or corrupt when they need them. Once a month, try restoring a random file, and once a quarter a whole system, and note how long it takes.

1. Choose the file or system to restore.
2. Restore it to a test environment.
3. Check that the data is complete and opens correctly.
4. Record the time taken and any problems you hit.

Whose job is it?

Backups should not depend on one person remembering them. Put the owner, the frequency and the test schedule in writing. If you have no in-house team, buying this as a managed service is usually far cheaper than the cost of losing data.

Summary

• Three copies, two media, one off site.
• At least one immutable backup.
• Regular, documented restore tests.