Short answer
The 3-2-1 rule means: 3 copies of your data, on 2 different kinds of storage, with 1 of them somewhere else. Against ransomware, add a copy that cannot be altered and regular test restores: an untested backup is not a backup.
The three numbers
- 3 copies: the original data plus two backups.
- 2 kinds of storage: for example the office server and a NAS or a cloud service. If one type of disk has a problem, the other survives.
- 1 somewhere else: a copy outside the office that survives a fire, a flood or a theft.
Why an external hard drive isn't enough
Ransomware encrypts everything the computer can see, including a connected external drive. And a drive kept next to the computer is lost with it in a theft or fire.
What else you need in 2026
- An immutable copy: one that, once written, cannot be deleted or changed for a set period, not even with the administrator password.
- Test restores: once a month, actually recover a file or a whole server.
- Failure alerts: if today's backup failed, someone needs to know today, not in six months.
- Email and cloud: Microsoft 365 and Google Workspace don't replace a backup; an accidental deletion syncs everywhere.
How often
Ask how many hours of work you can afford to lose. For documents, daily. For accounting and databases, several times a day.
Checklist
- Do you know exactly what data the business has and where it lives?
- Is there a copy outside the office?
- Is there a copy that ransomware cannot change?
- When did you last restore something from backup?
- Who gets the alert when a backup fails?