The 3-2-1 Backup Rule for Small Businesses
Three copies, two types of storage, one off-site. How a small business can apply the 3-2-1 backup rule with external drives, a NAS and cloud backup.
Sooner or later, every business faces data loss. A laptop is stolen, a hard drive fails, someone deletes the wrong folder, or ransomware locks every file on the network. What matters is whether you can get it back. The 3-2-1 rule is a simple, well-tested way to make sure you can.
What the 3-2-1 rule means
- 3 copies of your data: the original plus two backups.
- 2 different types of storage: for example, a NAS in the office and a cloud backup, or an internal drive and an external drive.
- 1 copy off-site: somewhere a fire, flood or burglary at your premises cannot reach.
Why each part matters
- Hardware failure: drives can fail without warning, so a second copy on different hardware covers you.
- Theft, fire and floods: if every copy sits in the same office, one incident can take them all. Monsoon flooding and lightning are real risks in parts of Sri Lanka.
- Ransomware: it encrypts files on the infected computer and on drives and shared folders connected to it, including a backup drive that is always plugged in.
- Human error: accidental deletions and overwritten files happen in every office.
What to back up
- Accounting data, invoices and tax records.
- Customer and supplier records, quotations and contracts.
- Email, especially if it is stored on only one computer.
- Shared folders, design files and product photos.
- HR and payroll records.
- Your website files and database.
- Exported CCTV clips of any incident you may need later.
A practical 3-2-1 setup for a small office
| Copy | Where it lives | Protects against |
|---|---|---|
| 1. Working data | PCs, laptops or a file server | Nothing on its own |
| 2. Local backup | NAS or external drive, updated daily | Drive failure, deleted files; allows quick restores |
| 3. Off-site backup | Cloud backup service, or a drive rotated to another location | Theft, fire, flood and ransomware |
A NAS (network attached storage) with two drives is a popular local option because it can back up several computers automatically. RAID, which mirrors the drives inside the NAS, protects against a single drive failing. It is not a backup on its own, because deletions and ransomware are mirrored too.
Sync is not backup
Google Drive, OneDrive and Dropbox are excellent for sharing and working from anywhere, but they sync changes. If a file is deleted or encrypted on one device, the change can spread to every copy. Recycle bins and version history help, but they keep items for a limited time, so use a backup tool with versioning and its own retention settings as well.
Protect your backups from ransomware
- Keep at least one copy offline or immutable: a drive that is disconnected after each backup, or a cloud backup that cannot be changed or deleted for a set period.
- Use separate credentials for the backup system and protect them with multi-factor authentication.
- Do not leave backup drives permanently connected to everyday PCs.
Some vendors extend the rule to 3-2-1-1-0: one copy offline or immutable, and zero errors when you test your restores.
How often, and for how long?
Back up anything that changes daily at least once a day, automatically. Keep enough history to recover from problems you notice late, such as daily copies for a month and monthly copies for a year. Encrypt backups that contain customer or staff details and keep them only as long as you need them. The Personal Data Protection Act, No. 9 of 2022 provisions on processing personal data come into operation on 1 January 2027, so now is a good time to review this.
Test your restores
A backup you have never restored is only a hope. Every few months, restore a folder and, if you can, a whole computer to check that it works and to see how long it takes. Write the steps down so someone else can follow them.
Local tips
- Put the NAS and router on a UPS. A power cut in the middle of a backup can corrupt data.
- Keep drives somewhere cool and dry, because heat and humidity shorten their life.
- Schedule cloud uploads overnight, especially on 4G connections with data limits.
Frequently asked questions
Is RAID the same as a backup?
No. RAID keeps a NAS or server running if one drive fails, but deleted, corrupted or encrypted files are mirrored across the drives. You still need separate backups.
Is Google Drive or OneDrive enough on its own?
Not really. They help if a laptop is lost, but sync can spread deletions and ransomware, and deleted items are kept only for a limited time. Treat them as one copy and back them up separately.
How long does the first cloud backup take?
It depends on how much data you have and your upload speed, and on a slow connection the first full upload can take days. Start with the most important folders and run uploads overnight. After that, backups send only the changes.
We can help you design a 3-2-1 setup with a NAS, external drives and cloud backup: see our storage and backup services, or call our Kandy team on +94 72 299 9915 or email info@eudora.lk.
Eudora Technology is a Kandy-based team working on CCTV, networks, IT support, cloud and websites for homes and businesses across Sri Lanka.
