Backups that actually work: the 3-2-1 rule

In recent years, ransomware has gone from being a distant problem for large corporations to an everyday threat. This 2018, the attacks that hijack information and demand a ransom keep rising, and small businesses are an easy target: they hold valuable data and often lack a formal defense. One day someone opens an email, clicks where they shouldn’t, and suddenly the entire customer database, the billing, and the operational files show up encrypted with a message demanding money.

This is where many businesses discover the uncomfortable truth: they had “a backup,” but it was useless. It was on the same machine that got infected, or it was eight months old, or nobody knew how to restore it. A backup you can’t recover when you need it isn’t a backup, it’s an illusion. The good news is that there’s a proven rule, simple to understand and apply, that turns your copies into a real safety net: the 3-2-1 rule.

What the 3-2-1 rule is

The 3-2-1 rule is a principle IT professionals have used for years because it works regardless of company size. It boils down to three numbers:

• 3 copies of your information. The original file plus two backups. If one copy fails, you still have two others.
• 2 different types of media. Don’t put everything in the same place: for example, a disk in the office and a cloud service. That way a hardware problem doesn’t take everything down.
• 1 copy off-site. At least one backup should live in another physical location or in the cloud, far from the fire, the theft, or the ransomware that got in through the local network.

The logic is simple: disasters rarely respect a single point. Diversifying where and how you store your data makes it nearly impossible to lose everything at once.

Why it matters to a small business

For a small or medium-sized business, information is the business: your customer history, your quotes, your accounting, the processes it took you years to fine-tune. Losing that isn’t a technical nuisance, it’s halting the operation and, sometimes, not being able to start it up again.

Ransomware understands this well, which is why it attacks exactly there. But even without a cyberattack, data is lost for much more common reasons: a hard drive that dies, a machine that gets wet, an employee who deletes the wrong folder. The 3-2-1 rule covers you in all those scenarios equally, without you having to guess which one will hit you.

A backup isn’t useful because it exists, but because it can be restored the day everything fails.

An untested backup doesn’t count

Having the copies is half the work. The other half, the one almost everyone forgets, is making sure you can really recover them. A backup that’s never been tested is an unverified promise.

• Test the restore. Every so often, recover a few files and confirm that they open properly and are complete.
• Automate the copies. Anything that depends on someone remembering will, sooner or later, be forgotten. Schedule your backups to happen on their own.
• Keep an eye on them. Check that the process didn’t quietly stop weeks ago.
• Guard the access. The off-site copy should be protected so the same attack can’t reach it.

Build your 3-2-1 in four steps

You don’t need a huge infrastructure to be protected. Start with the essentials and grow as your operation demands:

• Identify which data is critical. Customers, billing, contracts, files. Prioritize what you couldn’t rebuild.
• Define your 3-2-1. Choose two different media and one off-site location; the cloud handles that external copy very well.
• Automate and schedule a test. Schedule the copies and mark a quarterly test restore on the calendar.
• Document the procedure. Don’t let it depend on a single person: anyone on the team should be able to recover the data by following the instructions.

At Normandia Web, we help Mexican small businesses set up backups that actually work, integrated into their software so their information can withstand any blow. The goal isn’t just to have copies: it’s the peace of mind of knowing that, even if everything fails, the business stays standing.