The 3-2-1 Backup Rule for Small Business

What the 3-2-1 Backup Rule Says

The 3-2-1 rule is a plain guideline for protecting important data. The US Cybersecurity and Infrastructure Security Agency (CISA) describes it this way:

• 3: Keep three copies of any important file, one primary and two backups.
• 2: Keep the files on two different media types to protect against different types of hazards.
• 1: Store one copy offsite, outside your home or business facility.

The idea is that no single event should be able to destroy every copy. A failed drive, a stolen laptop, a fire or a hacked account should each leave at least one good copy behind.

Why the Rule Matters for a Small Business

Small businesses rarely lose data in dramatic ways. It is usually something ordinary: a website update that breaks the database, a staff member deleting a shared folder, a hosting account that gets suspended, or a laptop that dies the week before a deadline.

Ransomware is the bigger threat. CISA's ransomware guidance warns that many ransomware variants look for accessible backups and delete or encrypt them so the victim has no choice but to pay. A backup that sits on the same network, with the same logins, can be lost in the same attack. That is why CISA recommends keeping offline, encrypted backups of critical data and testing them regularly.

How to Apply 3-2-1 in Practice

Copy One: Your Live Data

This is the working copy: your website, your shared drive, your accounting file, your CRM. It is the copy most likely to be damaged, because it is the one people and software touch every day.

Copy Two: A Local or Same-Provider Backup

A second copy kept close by makes quick restores easy. For a website, this is often a nightly snapshot on the hosting platform. For office files, it may be a backup drive or a second storage service. It is useful for small mistakes, such as restoring one page or one file.

Copy Three: An Offsite, Separate Backup

The third copy is the one that saves you in a real disaster. It should live with a different provider or in a different location, use different credentials, and be encrypted. If your hosting company, your office or your main admin login is compromised, this copy should still be untouched.

What a Small Business Should Back Up

Many owners think of backups as copies of office documents. In practice, the systems that would hurt most to rebuild are often online. Make a list that covers:

• Website files and the website database. A WordPress site, for example, needs both to be restored.
• Online store data, including orders, customers and product catalogs.
• Email and shared drives in your cloud workspace. Cloud providers keep services running, but deleted or overwritten data may not be recoverable after their retention period ends.
• CRM records, help desk tickets and signed documents.
• Accounting files and exports from any software that does not keep its own history.
• DNS settings, domain registrar details and the list of accounts that control them.
• Configuration for custom applications, so a server can be rebuilt instead of recreated from memory.

For each item, note who owns it, how it is backed up today and where the copies live. Gaps usually show up quickly.

Common Gaps We See

• Backups that live on the same server as the website, so a server failure takes both.
• A single backup copy that gets overwritten every night, so a problem noticed a week later cannot be undone.
• Website files backed up, but not the database, or the other way around.
• Backups that use the same admin account as the live system.
• Backups nobody has ever tried to restore.

Recovery Goals: RPO and RTO

Two terms help you decide how much protection you need. NIST defines the recovery point objective (RPO) as the point in time to which data must be recovered after an outage. In plain terms, it is how much recent work you can afford to lose. If you back up once a night, you could lose up to a day of orders or form submissions.

The recovery time objective (RTO) is how long a system can be down before it seriously hurts the business. An online store and a brochure site have very different answers. Write both numbers down for each important system, then pick a backup schedule and restore plan that meets them.

A Backup Is Only Real After a Restore Test

A backup job that reports success is not proof that you can recover. Files can be incomplete, encryption keys can be lost, and restore steps can be forgotten. CISA advises testing the availability and integrity of backups in a disaster recovery scenario on a regular basis.

A simple test plan for a small business looks like this:

1. Pick one system, such as the website.
2. Restore the most recent offsite backup to a separate test location.
3. Check that pages load, forms work and recent content is present.
4. Time the process and compare it to your RTO.
5. Write down each step so someone else can repeat it.
6. Repeat on a schedule and after major changes.

Do Not Forget Retention

Retention is how long old backups are kept. If you keep only yesterday's copy, malware or a bad edit that went unnoticed for two weeks is already in every backup you have. Keeping a mix of daily, weekly and monthly copies gives you more points in time to restore from.

How 1REALTOUR Helps

1REALTOUR runs encrypted, off-site backups with scheduled restore tests for the websites and applications we manage. We set retention, document recovery steps and confirm restores actually work instead of trusting a green checkmark. See our backup and disaster recovery service, or pair it with managed WordPress hosting and ongoing website maintenance.