3-2-1 backup rule: protecting an SME's data

A backup serves one purpose only: being able to restore. The 3-2-1 rule is the reference method for getting there, whatever the size of the business.

The rule in three numbers

Why it is no longer enough on its own

Ransomware also seeks out and encrypts backups that can be reached from the network. The rule has therefore been extended: at least one copy must be immutable (impossible to modify or delete for a defined period) or offline, and restore tests must complete without errors. This is sometimes called the 3-2-1-1-0 rule.

What to back up

• Servers and file shares.
• Microsoft 365: e-mail, OneDrive, SharePoint, Teams.
• Business application databases.
• Firewall, switch and Wi-Fi configurations.
• Documentation, accessible even when the network is down.

Two values to set: RPO and RTO

The RPO (recovery point objective) is the acceptable data loss: with one backup per night, you can lose up to a day of work. The RTO (recovery time objective) is the acceptable downtime before the system is usable again. Both values are decided system by system, based on the impact on the business, and they determine how often backups run and how restores are done.

Test the restore

A backup that has never been tested is an assumption. Schedule regular tests, from a single file up to a complete server, measure the time required and record the result. This is also what insurers and auditors ask for.

Common mistakes

• A USB drive that stays plugged in, encrypted at the same time as the server.
• All the copies on the same NAS, in the same room.
• Failure alerts that nobody reads.
• Retention that is too short, when an attack can go unnoticed for several weeks.
• Backup credentials identical to the network accounts.