Data Backup: The 3-2-1 Rule in a Small Business

Why many backups do not help in an emergency

Asked about backups, most owners answer: the IT service provider does that, something runs every night. That is usually true. Whether the backup is complete, whether an attacker can encrypt it as well, and how long a restore takes, however, often nobody knows. Security providers report that backups in small businesses are often never restored, so nobody knows what state the data will be in when it matters (Wilson and McDonald 2025).

This leads to the guiding question of this guide: what does a backup concept look like that enables a small business to work again within a defined time after a defect, a mistake, or an attack? To answer it, we clarify the terms, present a thinking model from business continuity management, look at the findings, weigh two perspectives on the role of the cloud, and describe a concept in six steps.

What is backed up is not what was copied, but what can be brought back.

What is a backup, and what does the 3-2-1 rule require?

A backup is a copy of data kept separately from the original in order to restore it after a loss. It differs from synchronization, in which changes are transferred immediately to all devices, including deletion and encryption. And it differs from archiving, which keeps data unchanged over legal retention periods. Which periods apply is described in the article on what must be kept and for how long.

The best-known minimum rule is the 3-2-1 rule, also mentioned in the guide on basic IT security for small businesses: there are at least three copies of important data on two different media, one of them off-site or disconnected from the network. In addition, it says there: one copy is unreachable for an attacker on the network, for example because it is disconnected after the backup or cannot be changed.

The thinking model: acceptable data loss and acceptable downtime

The 3-2-1 rule says how many copies there should be, but not how often to back up or how quickly things must run again. These questions are answered by a thinking model from business continuity management. The guide on the emergency folder presents its first step, the business impact analysis. It asks for every important function how long it may fail before serious damage occurs. This period is called the maximum tolerable downtime.

Two target values follow for backups. The acceptable data loss, or recovery point objective, is the period before an incident whose data may be lost. Whoever backs up once a night loses one working day in the worst case. The recovery time, or recovery time objective, is the time until a system must be usable again after an incident. It must be shorter than the tolerable downtime, because detecting, deciding, and procuring also take time.

An everyday analogy makes the two figures tangible. Whoever takes their car to the garage asks two things: what is lost if it no longer starts, and how long can I manage without a car? Whoever drives to customers every day needs a replacement the same day. Whoever uses it only at weekends can wait. Backups follow the same logic.

What surveys show about backups in an emergency

How backups perform in an emergency is shown by an annual survey by the security provider Sophos. For the 2025 edition, 3,400 IT and security leaders in 17 countries whose organizations had been hit by ransomware were surveyed. Almost everyone whose data was encrypted got it back. But backups were used for this in only 54 percent of cases, the lowest rate in six years. 49 percent paid a ransom. A survey by a vendor of security technology should be read with caution, but the direction is clear: where the backup does not hold, the only option left is to pay.

Why small businesses are particularly vulnerable is summarized by Awan and Alam (2025) in a systematic review of 73 journal articles. According to their analysis, small and medium-sized enterprises are at risk from ransomware because backup strategies are weak and capabilities for restoration are low. More recent literature therefore focuses more on lean incident response plans and guidelines for backup and recovery. According to the studies cited, businesses with a prepared plan return to normal operations faster.

In Germany, the situation is no more relaxed. In the 2026 economic protection study by the digital association Bitkom, 67 percent of companies surveyed with ten or more employees confirmed a successful attack in the last twelve months. How such attacks proceed is described in the article on cyberattacks on small businesses. Its sequence of protective measures starts with a backup an attacker cannot reach.

Is the cloud enough as a backup? Two perspectives

The first perspective says: whoever works in the cloud is backed up. The data lies in data centers with multiple storage, the provider takes care of hardware and outages, and a separate backup would be duplicate work. This is supported by the fact that large providers handle hardware defects better than any small business.

The second says: the cloud is a storage location, not a backup. A provider protects its operation, not every folder an employee accidentally deletes. Synchronized folders also transfer encryption and deletion. And a locked account or a terminated contract can end access to all data at once.

I consider the second perspective correct. The cloud does not replace the backup; it only shifts where the original lies. The guide on basic IT security states: cloud services are backed up too, because an accidentally deleted folder is just as gone there as locally. How the choice between cloud and own server turns out overall is described in the comparison cloud or own server.

A backup concept in six steps

1. Take stock of the data

   Where is which data? Server, cloud storage, email, accounting at the tax office, industry software, individual computers, phones. Whatever does not appear anywhere will not be backed up either.

2. Set target values

   For each type of data, determine the acceptable data loss and the recovery time, derived from the tolerable downtime of the function that needs the data.

3. Implement 3-2-1

   At least three copies on two media, one off-site or disconnected. The backup frequency follows the acceptable data loss.

4. Make one copy unreachable

   One backup is disconnected from the network after the run or cannot be changed for a defined period. The credentials for it are not stored on the same computers.

5. Test the restore

   Restore a file or folder once a quarter and an entire system once a year. The duration is measured and compared with the recovery time.

6. Record and assign

   Who is responsible for the backup, who checks it, where are the restore instructions? The answers belong in the emergency folder.

A worked example shows why the test matters so much. A business with 20 workstations is encrypted. How long it takes to be able to work again depends almost entirely on the state of the backup. The values are the same as in the guide on basic IT security and are freely chosen.

• All data locations are known, including cloud services and the tax office.
• For each type of data there is an acceptable data loss and a recovery time.
• There are three copies on two media, one off-site or disconnected.
• At least one copy is unreachable for an attacker on the network.
• The last restore test was less than three months ago.
• The restore instructions are in the emergency folder, also on paper.

Whoever has the backup run by a service provider should write the target values and the test into the contract. Which other points belong there is described in the guide on finding the right IT service provider.

What follows beyond the technology, and where the limits lie

A backup is first a question of responsibility. It usually runs automatically, and precisely for that reason nobody notices when it has been failing for weeks. It therefore needs a person who reads the reports, schedules the tests, and reports the result at the management meeting. The Swiss cheese model from the article on cyberattacks also fits here: technology, rule, and check are separate layers, and damage occurs when the holes of all three line up.

One limit lies in the order of the data itself. Whoever does not know which version of a quote is valid will, even after a restore, only restore the mess. A clear filing structure, as described in the guide on digital filing, makes the backup smaller, faster, and easier to check. A second limit is the budget: every hour less of data loss costs more. The target values are therefore a business decision, not a technical one.

Conclusion: what makes a backup usable in an emergency?

The question was
a backup concept looks like that enables a small business to work again within a defined time after an incident. The answer has three parts. The 3-2-1 rule is the minimum form: three copies, two media, one off-site or disconnected, with one copy an attacker cannot reach. The two target values, acceptable data loss and recovery time, turn it into a concept that fits your own processes.

The third part decides everything: the test. The surveys show that backups often cannot be used in an emergency and those affected then pay. A backup that is restored regularly is insurance. One that has never been checked is an assumption.

What you can do this week

1. Write down all the places where your business's data is stored, including cloud services.
2. For the three most important types of data, decide how much data loss is acceptable and how quickly they must be available again.
3. Check with your service provider whether the 3-2-1 rule is met and one copy is unreachable for attackers.
4. Have a file from yesterday and one from four weeks ago restored and time it.
5. Enter responsibility, test dates, and restore instructions in the emergency folder.