The 3-2-1 rule is the simplest way to make sure no single mistake, attack, or disaster can wipe out your business data: keep 3 copies, on 2 different types of storage, with 1 kept somewhere separate.
In our last post, Do You Still Need a Backup If You Use OneDrive or Google Drive?, we explained why syncing files to the cloud isn’t the same as backing them up. The most common follow-up question we got: “OK, so what should a backup look like?”
This guide answers that in plain English: what each number in 3-2-1 means, what it looks like for a typical Chicago office, what data people forget, and what to ask any IT provider before you trust them with your backups.
The 3-2-1 rule, one number at a time
3 copies of your data
Your original files count as one copy. Then you need two more. Why three? Because backups fail too: a drive dies, a subscription lapses, a setting gets changed. With three copies, one failure is an inconvenience, not a disaster.
2 different types of storage
If all your copies live in the same place, the same problem can hit all of them at once. Use at least two different kinds of storage, for example:
- Microsoft 365 or Google Workspace (where your team works every day), plus
- A separate backup service, a backup appliance in the office, or an external drive
1 copy kept separate
At least one copy should live somewhere a single event can’t reach: off-site, in a different cloud, or in an account with different logins. This is what protects you from:
- A fire, flood, or break-in at the office
- Ransomware that spreads to every connected drive
- A hacked Microsoft 365 or Google admin account
A backup drive plugged into the same computer it’s backing up does not count as separate. If ransomware can see it, ransomware can encrypt it.
What to back up (and what people forget)
Most owners think of “files.” A real backup plan covers everything you’d need to keep the business running. Check each one:
- Shared files and folders in OneDrive, SharePoint, or Google Drive
- Business email, including attachments and calendars. Many businesses back up files but not email.
- Microsoft Teams or Google Chat conversations and shared files
- Accounting data, such as QuickBooks company files stored on a PC or server
- Industry software and its database (practice management, scheduling, point-of-sale, client records)
- Laptops and desktops, especially the Desktop and Downloads folders where people save things “just for now”
- Former employees’ accounts, saved before the account is deleted
- Website files and database, if your host doesn’t back them up for you
- Passwords and admin logins, stored in a business password manager so you can actually get to everything after a problem
If something on this list would stop your business for a day if it vanished, it needs to be in your backup plan.
Two questions that shape your backup plan
IT people use fancy terms for these, but they come down to two plain questions every owner can answer.
1. How much work can you afford to lose? If your last backup ran last night and your files vanish at 4 p.m., you lose a day of work. Is that OK? For a busy front desk or accounting office, maybe not. The answer tells you how often backups need to run: daily, every few hours, or continuously.
2. How fast do you need to be back up and running? Could your business survive two days without its files? Two hours? The answer tells you how quickly you need to restore, and whether you need a copy you can get to fast (in the cloud or in the office), not just one stored far away.
Write your answers down. They’re the most useful thing you can bring to a conversation with any IT provider.
Going further: 3-2-1-1-0
Ransomware has changed the game, so many IT pros now recommend an upgraded version of the rule, 3-2-1-1-0. It adds two more numbers:
- 1 copy that can’t be changed or deleted. Often called an immutable or air-gapped backup. Even if an attacker gets your passwords, they can’t erase or encrypt this copy. Modern ransomware often goes after backups first, so this copy is your last line of defense.
- 0 errors when you test it. Backups are only useful if they actually restore. Schedule a test restore at least twice a year, and check that the files open and are up to date.
You don’t need to be an IT expert to ask for these. Just ask your provider: “Do we have a copy that can’t be deleted, and when did we last test a restore?”
8 questions to ask any IT provider about backups
Whether you work with us or someone else, a good IT provider should answer these clearly, without jargon:
- What exactly is being backed up: files, email, Teams, laptops, accounting data?
- How often do backups run?
- How long are older versions kept?
- Where are the backup copies stored, and is at least one separate from Microsoft or Google?
- Is there a copy that can’t be deleted or changed, even by an admin?
- When was the last test restore, and did it work?
- How long would it take to get us back up and running after ransomware?
- Will you alert us if a backup fails?
If you hear “I’m not sure” or “Microsoft handles that” more than once, it’s worth a second opinion.
Get a free backup gap review
Want a second opinion on your current setup? We’ll take a look for free. In about 20 minutes, we’ll check your setup against the 3-2-1 rule, show you exactly what is and isn’t protected, and give you a plain-English list of what to fix first. No cost, no obligation, no tech jargon.
Call 2nd Chance PC Techs at 773-800-7544 or email us at info@2ndchancepctechs.com and mention “backup review.”
2nd Chance PC Techs LTD is a Chicago-based managed IT provider helping small businesses and nonprofits stay secure and productive, with 17 years of hands-on IT experience behind every recommendation. www.2ndchancepctechs.com