The 3-2-1 backup rule: protecting your data effectively
The 3-2-1 rule is the foundation of a reliable backup strategy. Here is how to apply it in practice in a small or mid-sized company.
The principle
The 3-2-1 rule is easy to remember:
- 3 copies of your data (the original + 2 backups)
- 2 different types of media (local server, NAS, tape, external drive…)
- 1 copy off site (cloud, remote datacentre, safe)
The principle has been around for years, yet it remains surprisingly rarely applied in small and mid-sized companies.
Putting it into practice in a smaller company
Copy 1: the local backup
A NAS or a dedicated backup server on the local network. Favour daily incremental backups to limit the impact on bandwidth.
Copy 2: a different medium
A rotating external drive, a separate storage array or a second NAS. The point is not to depend on a single technology. If your main NAS fails (RAID controller, corrupted firmware), this copy takes over.
Copy 3: off site
Encrypted cloud storage or a replica to a second physical site. This copy protects against fire, theft and water damage.
Common mistakes
- Never testing your restores. A backup that does not restore is not a backup. Schedule a restoration test at least once a quarter.
- Backing up to the same server. A snapshot on the same disk protects against nothing.
- Forgetting SaaS data. Online collaboration suites (email, drive) do not on their own guarantee granular restoration of your data. Plan for a third-party backup solution.
- Ignoring retention. If ransomware encrypts your files and you only keep 7 days of retention, you risk recovering nothing but encrypted files. Aim for 30 days minimum, 90 days ideally.
In short
The 3-2-1 rule is not a luxury reserved for large companies. With a NAS, an external drive and cloud storage, a smaller company can protect its data for a few hundred euros a year. The cost of losing data, on the other hand, runs into thousands – even tens of thousands of euros.