Backups That Actually Save You: The 3-2-1 Rule for Small Business

Modern ransomware doesn’t just encrypt your files — the first thing intruders do after getting in is find and destroy your backups, because backups are what let you refuse to pay. Which means "we back up to a drive in the office" is no longer a backup strategy; it’s a target list.

The rule: 3-2-1

• 3 copies of your important data (production plus two backups).
• 2 different media or systems (e.g. a local backup appliance and a cloud service).
• 1 copy offsite and offline or immutable — somewhere ransomware inside your network cannot reach or rewrite.

The word doing the heavy lifting is immutable: a backup that can be written once but not altered or deleted for a set period, even by an administrator account. Most reputable cloud backup services now offer this — turn it on.

Back up the business, not just the files

Ask: "if the office burned down tonight, what would I need to trade by Friday?" That list usually includes Microsoft 365 mail and files (which, contrary to popular belief, Microsoft does not comprehensively back up for you), your accounting system, customer records, and the configuration of any line-of-business app. Back up those — not just the shared drive.

An untested backup is a hope, not a plan

Twice a year, restore something for real: a folder, a mailbox, a whole machine. Time it. The first test almost always finds a surprise — an excluded folder, an expired credential, a restore that takes three days instead of three hours. Far better to meet that surprise on a quiet Tuesday than mid-incident. Write the result down; your insurer will love you for it.