Backing up business data with the 3-2-1 rule: onsite, offsite and cloud backup
Accounting data, customer documents and email are things a business cannot do without, yet many businesses only find out that their backup does not work on the day a hard disk fails, a computer is stolen or files are encrypted by ransomware. The 3-2-1 rule is a simple, widely accepted approach to building backups that can genuinely be restored.
What is the 3-2-1 rule?
- 3: keep at least 3 copies of the data, namely the live data plus two backup copies
- 2: store the backups on at least 2 different types of media or systems, such as a storage device in the office and a cloud service
- 1: keep at least 1 copy offsite, to guard against events that hit the whole office, such as fire, flood or theft
How onsite, offsite and cloud backup differ
| Type | Strengths | Limitations |
|---|---|---|
| Onsite | Fast to restore, suits large volumes of data | Can be lost along with the office in a serious incident |
| Offsite | Kept apart from incidents at the office | Needs a routine for regularly taking media or data off the premises |
| Cloud backup | Automatic, accessible from many places | Depends on internet speed, and access rights must be tightly controlled |
A good system usually combines all three, for example backing up to a device in the office every night for fast restores, and sending another copy to the cloud for safety offsite.
Set clear RPO and RTO targets
- RPO (Recovery Point Objective): how far back in time you can afford to lose data, such as no more than 1 day, which sets how often you back up
- RTO (Recovery Time Objective): within how many hours you must be working again, which sets the type and speed of recovery
Not every system matters equally. Accounting and email systems usually need a shorter RPO and RTO than old document files.
Protect your backups from ransomware
- Keep at least one copy in a form that cannot be changed or deleted for a set period, or that is disconnected from the network
- Use accounts and passwords for the backup system that are separate from those used for day-to-day work, and turn on multi-factor authentication
- Encrypt the backups, especially those stored offsite or in the cloud
Test restores regularly
Set a testing cycle, such as every quarter, in which you actually restore sample files and key systems, record the time taken and compare it with your RTO. Testing helps you find problems before the day you really need the backup.
What data needs backing up?
- Databases of the accounting system and core business systems
- Document files on servers or shared file storage
- Email and data in cloud services, such as email and online document systems, where the provider does not guarantee recovery in every case
- Network device settings and the password records needed to restore systems
Frequently asked questions
Our files are already stored in the cloud. Do we still need backups?
Yes. Cloud file storage helps with access and syncing, but if files are deleted or encrypted, the damage may be synced as well. A separate backup lets you restore earlier versions.
How long should backups be kept?
It depends on the needs of the business and its legal obligations, such as accounting documents, which must be kept for at least 5 years. Set retention periods separately for each type of data.
Who should be in charge of the backup system?
There should be a clearly named person who checks the backup results every day and reports the results of restore tests to management at regular intervals.
Let us help you set up your backups
Kerwin & Vance designs and builds IT infrastructure to suit the size of your business, with backup systems covering onsite, offsite and cloud backup. Find out more about our Technology services, or book a consultation with us.