Small business data backup: the 3-2-1 rule explained

A dependable small business backup follows the 3-2-1 rule: keep three copies of anything important, on two different kinds of storage, with one copy somewhere other than your office. Add one copy that cannot be altered or deleted, run backups automatically, and restore a file on a schedule to prove it works. For most offices that means a cloud backup service, often a local copy for fast restores, and a separate backup of Microsoft 365 or Google Workspace data.

What is the 3-2-1 backup rule?

The rule comes from long-standing guidance that the federal Cybersecurity and Infrastructure Security Agency publishes in its data backup options paper:

• 3: keep three copies of any important file, the original and two backups.
• 2: keep the files on two different media types, so one kind of failure cannot take out both.
• 1: store one copy offsite, outside your business premises.

In practice, picture a bookkeeping file that lives on an office computer (copy one), is backed up nightly to a storage device in the office (copy two, different media), and is also backed up to a cloud service (copy three, offsite). A failed drive, a stolen laptop, or a fire each leave at least one copy intact.

What does 3-2-1-1-0 add?

Ransomware changed the threat. Attackers look for backups and try to encrypt or delete them first. Backup vendor Veeam popularized an extended version of the rule that adds two items:

• 1 immutable or air-gapped copy. Immutable means the copy cannot be changed or deleted until a set date, even by an administrator. Air-gapped means it is physically disconnected.
• 0 errors. Backups are verified, so you know they restore.

CISA’s #StopRansomware Guide gives the same advice in different words: maintain offline, encrypted backups of critical data, and regularly test their availability and integrity.

What should a small business back up?

Start with a list of where your data lives. Include what would be hard or impossible to recreate:

• Accounting and tax files, including QuickBooks company files
• Customer records, contracts, and project files
• Email, calendars, and contacts
• Files in Microsoft 365 (OneDrive, SharePoint, Teams) or Google Workspace
• Line-of-business application data, such as a practice management or job costing database
• Shared folders on a server or network storage device
• The settings that are tedious to rebuild: firewall configuration, license keys, and a list of installed software

Records you are legally required to keep belong on the list too. If you are in healthcare, finance, or law, your retention rules may decide how long backups must be kept.

You can usually skip the operating system and installed programs on ordinary staff computers, since those are reinstalled rather than restored. A server is different: a full image backup of a server saves many hours of rebuilding.

Is data in Microsoft 365 or Google Workspace already backed up?

Partly. Both keep your data highly available, and both have recycle bins and version history. Those features have time limits, and they are not an independent copy.

• SharePoint and OneDrive keep deleted items in the recycle bin for 93 days.
• OneDrive’s Files Restore can roll an entire OneDrive back to a point within the last 30 days.
• Exchange Online keeps deleted email recoverable for 14 days by default, adjustable up to 30.

Sync is also not backup. If a file is deleted or encrypted on one computer, that change syncs everywhere. A deletion nobody notices for four months is outside every window above. That is the case for backing up cloud data separately, which we cover in more depth in our guide to Microsoft 365 backup.

Local backup vs cloud backup: which do you need?

Most offices benefit from both, because they solve different problems.

	Local backup (external drive or network storage)	Cloud backup
Restore speed	Fast, limited only by your office network	Limited by your internet connection
Survives fire, theft, or flood at the office	No	Yes
Survives ransomware on the office network	Only if disconnected or immutable	Yes, if versioned or immutable
Ongoing effort	Someone must check it and replace drives	Mostly automatic
Cost pattern	Upfront hardware	Monthly or annual subscription

If you have to pick one, pick cloud. It covers the offsite requirement without anyone remembering to carry a drive home. An office with very large files (video, CAD drawings, medical imaging) gains the most from adding a local copy, because pulling a terabyte back over a typical internet connection can take days.

What does immutability mean, and how do you get it?

An immutable backup is locked against change for a retention period you choose. Ransomware running with stolen administrator credentials still cannot delete it. Common ways a small business gets an immutable copy:

• Object Lock on cloud storage. Backblaze documents that its B2 Object Lock prevents a file from being changed or deleted until a given date, and that in compliance mode the lock cannot be removed by any user. Many backup programs can write to storage with Object Lock turned on.
• A backup service with built-in immutability. Microsoft states that Microsoft 365 Backup copies are immutable unless the backup administrator removes the whole service.
• An offline copy. An external drive that is unplugged and stored elsewhere cannot be reached by malware. It relies on a person doing the rotation, so treat it as a supplement.

Also protect the backup account itself: a separate login that is not used for daily work, with multi-factor authentication turned on.

How often should backups run, and how long should you keep them?

Work backward from how much work you could stand to redo. If losing a day of bookkeeping is tolerable, nightly is fine. If it is not, choose a tool that backs up continuously or several times a day. That tolerance has a name, the recovery point objective, and it is explained with a worked example in our IT disaster recovery plan guide.

Keep versions for long enough to catch slow problems. Thirty days of history is a minimum. Ninety days to a year is safer for accounting data, because a corrupted or deleted file is sometimes not noticed until quarter end or tax time.

How do you test that a restore works?

A backup report that says “success” only means files were copied. A restore test proves you can get them back.

1. Monthly: restore one random file and one folder to a different location, then open them.
2. Quarterly: restore something larger, such as a full mailbox, a QuickBooks company file, or a shared folder, and time how long it takes.
3. Yearly: for a server, restore the full image to spare hardware or a virtual machine and confirm it starts.
4. Every time: write down the date, what was restored, how long it took, and who did it.

Also turn on failure alerts and send them to a mailbox that more than one person reads. Backups tend to fail quietly, so nobody notices until a restore is needed.

What does small business backup cost?

Vendor list prices as of September 2026. Your total depends on how many computers and how much data you protect.

Option	Published price	Notes
Backblaze Computer Backup	$99 per computer per year	Unlimited data per computer. Includes 30 days of version history; one year or forever retention costs extra.
Backblaze B2 cloud storage	$6.95 per TB per month	Storage only. You supply backup software. Downloads are free up to three times the amount stored. Supports Object Lock.
Wasabi cloud storage	From $7.99 per TB per month	Storage only. Wasabi states there are no fees for downloads or API requests.
Microsoft 365 Backup	$0.15 per GB per month of protected content	Covers OneDrive, SharePoint, and Exchange. Billed through an Azure subscription. Backups stay inside Microsoft’s cloud.

To make that concrete, picture a five person office with five computers, 500 GB of shared files, and 200 GB of Microsoft 365 data. Computer backup would be about $495 a year. Storing the shared files in B2 would be about $3.50 a month plus the cost of backup software. Microsoft 365 Backup for 200 GB would be about $30 a month. Local hardware (an external drive or a network storage device) is a one-time purchase on top, and prices vary widely by capacity.

One trade-off to understand: Microsoft 365 Backup restores quickly, but the backup lives with the same vendor as the original. CISA suggests considering a copy with a separate provider so that a single compromised account cannot reach everything. Third-party Microsoft 365 backup services exist for that purpose and are typically priced per user.

Common backup mistakes

• The backup drive stays plugged into the computer it protects, so ransomware encrypts both.
• Backups are set up once and never checked again.
• Cloud data (Microsoft 365, Google Workspace, QuickBooks Online exports) is assumed to be covered and is not.
• One critical system, often the line-of-business database, was never added to the backup job.
• Only one person knows the backup login, and it is not written down anywhere safe.
• Nobody has ever restored anything.

When is a simple setup enough?

A sole proprietor whose work lives entirely in Microsoft 365 or Google Workspace, with nothing on a server and no regulated data, may only need a cloud-to-cloud backup of that account and a computer backup subscription. You do not need a server, a tape library, or an enterprise product. You need a second and third copy, one of them out of reach, and proof that a restore works.

Common questions

Is OneDrive or Google Drive a backup?

No. They are sync and storage services. They protect against a lost laptop, because your files are still in the cloud, but deletions and ransomware encryption sync too. Recycle bins and version history help for a limited period, 93 days for the SharePoint and OneDrive recycle bin. A backup keeps an independent history outside those limits.

How long does it take to restore from a cloud backup?

It depends on the amount of data and your download speed. A single file takes minutes. A full computer or several hundred gigabytes can take many hours to days on a typical office connection. That is the main reason offices with large files keep a local copy as well. Time a test restore so you know your own number.

Do backups need to be encrypted?

Yes. A backup is a full copy of your business data, so it deserves the same protection as the original. CISA’s ransomware guidance specifically recommends encrypted backups. Most cloud backup services encrypt data in transit and at rest. If you set your own encryption key, store it somewhere safe, because the vendor cannot recover it for you.

How is backup different from disaster recovery?

Backup is the copy of your data. Disaster recovery is the plan for getting the business running again: which systems come back first, who does what, and how long it should take. You need backups for a recovery plan to work, and the plan is what makes backups useful under pressure. See our disaster recovery plan outline.

How Coastal Growth Co. can help

We design, set up, and check backups for small businesses: working out what needs protecting, choosing local and cloud pieces that fit your data and budget, adding an immutable copy, and running documented restore tests. Backup checks can be a one-time project or part of ongoing managed IT, and they pair naturally with ransomware protection. Browse our services or get in touch, and we will agree on scope and price before any paid work begins.