The 3-2-1 rule
- 3 copies of important data: the original plus two backups
- 2 different kinds of storage, so one failure can't take out both
- 1 copy off-site or in the cloud, so a fire, flood, or theft doesn't end the business
Many businesses now add one more rule: at least one copy should be immutable, meaning it can't be changed or deleted for a set period. That's what protects you from ransomware that goes looking for backups.
What to back up
- Shared files and folders, wherever they live
- Email, calendars, and contacts in Microsoft 365 or Google Workspace
- Line-of-business software and its database, such as practice management, accounting, or inventory
- Server and computer configurations, so you can rebuild quickly
- Website content and databases
Cloud services still need backups
Microsoft 365 and Google Workspace keep your data available and keep deleted items for a limited time. That's retention, not backup. If an account is deleted, data is overwritten, or ransomware syncs encrypted files to the cloud, you may not be able to get everything back without a separate backup.
Test your restores
- Pick a file, a mailbox, and, if you have one, a server
- Restore each to a separate location on a schedule, such as quarterly
- Time how long it takes and write it down
- Fix anything that failed or took too long
The number that matters is how long your business can run without a system. If the answer is “a day” and a full restore takes three, you need a different plan.
Signs your backups need attention
- Nobody can say when the last successful restore test was
- Backups go to a drive that stays plugged into the server
- Backup failure emails go to someone who has left
- Cloud email and files aren't included