The 3-2-1 Backup Strategy for Small Business: How to Build Backups That Survive Ransomware

This is general information, not legal, tax, financial, medical or security advice. Rules and prices change, so confirm details with the official sources linked below or a qualified professional.

A 3-2-1 backup strategy means keeping three copies of important data (your original plus two backups), on two different types of storage, with one copy offsite. For a small business in 2026, add two upgrades: make at least one copy offline or immutable so ransomware can't delete it, and test restores on a schedule. That combination protects you from hardware failure, accidental deletion, theft, fire and most ransomware.

The rule is old because it works. CISA still publishes it in its guidance on backup options, and its ransomware guide adds the offline and testing requirements.

This is general information, not professional IT advice.

Key takeaways

• 3 copies, 2 media types, 1 offsite is the baseline, per CISA.
• Sync is not backup. OneDrive, Google Drive and Dropbox sync deletions and encrypted files.
• Keep one copy offline or immutable. CISA warns ransomware actively hunts for reachable backups.
• Back up your SaaS data too. Email, files, CRM and store data in the cloud still need a plan.
• Test restores quarterly. Time them, and fix what breaks.

The 3-2-1 rule, explained

CISA's guidance on data backup options summarizes the rule this way:

• 3: Keep three copies of any important file: one primary and two backups.
• 2: Keep the files on two different media types to protect against different hazards.
• 1: Store one copy offsite, outside your home or business facility.

In practice, "two media types" might mean a local network storage device plus a cloud backup service, or an external drive plus cloud storage. "Offsite" today usually means a reputable cloud backup provider, but it can also be a drive rotated to another secure location.

The 2026 upgrade: offline, immutable and tested

CISA's #StopRansomware Guide recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity. It explains why: many ransomware variants try to find and delete or encrypt accessible backups so victims have no choice but to pay. For cloud storage, it recommends enabling delete protection or object lock and versioning so data can't be silently overwritten.

That's why many practitioners describe an extended version, sometimes called 3-2-1-1-0: one copy offline or immutable, and zero errors on restore tests. The label matters less than the behavior.

What to back up

Don't forget the "glue": DNS records, domain registrar details, MFA recovery codes and license keys. Rebuilding without them can take longer than restoring the data itself.

Cloud and SaaS data: the gap most small businesses miss

Moving to Microsoft 365 or Google Workspace protects you from a failed server, but not from every risk. CISA's ransomware guide advises reviewing the cloud shared responsibility model to understand what the customer is responsible for, and suggests backing up data often, either offline or with cloud-to-cloud backups.

Risks a SaaS provider's own redundancy may not cover:

• A user, or an attacker with their password, deletes important files or mailboxes
• Ransomware on a laptop encrypts files that then sync to the cloud
• A retention period expires before anyone notices data is missing
• A former employee's account is deleted along with their data

A cloud-to-cloud backup service copies your SaaS data to separate storage on a schedule, keeps multiple restore points and lets you restore individual items.

Step-by-step: build your backup plan

1. List critical data and systems using the table above. Ask: if this disappeared today, what would stop?
2. Set recovery targets. For each system, decide how much data you can afford to lose (recovery point) and how long you can be down (recovery time).
3. Choose your three copies. For example: primary data in Microsoft 365, backup copy one in a cloud-to-cloud backup service, backup copy two on immutable or offline storage.
4. Make one copy offline or immutable. Use object lock or immutability settings in your backup service, or a rotated drive kept disconnected.
5. Encrypt backups and store encryption keys separately from the backups, in your password manager and an offline emergency kit.
6. Separate backup credentials. Use a different admin account, with phishing-resistant MFA, for the backup system, so compromising email doesn't compromise backups.
7. Set retention. Keep enough history to roll back past an undetected problem: for example, daily copies for several weeks plus monthly copies for a year.
8. Automate and monitor. Turn on alerts for failed backups and review them weekly.
9. Test restores quarterly and document the steps.
10. Review annually or whenever you add a major system.

Example 3-2-1 setups by business size

The pattern is the same everywhere: the third copy should live where the credentials that run your daily operations cannot delete it.

Where your backups live matters

If you serve clients in other countries, check contracts and privacy laws before choosing a backup region. Some customers require data to stay in a particular country or region, and privacy regimes such as Malaysia's Personal Data Protection Act impose obligations on how personal data is protected and, since June 2025, on how breaches are reported. Choose a backup provider that lets you pick storage regions and document where each copy lives.

Restore testing that actually proves something

Write down how long each restore took. If a full recovery takes three days and you can only afford one, you have found your next project.

From experience. When we moved a Malaysian clinic from paper records to a digital queue and EMR, the question "what happens if this device dies tomorrow?" belongs before go-live, not after. For Supabase- or Vercel-based products, my rule is simple: automated backups on at launch, and a named person owns restore testing.

Common backup mistakes

• Relying on sync and calling it backup
• Backups on the same network with the same admin credentials as production
• No backup of SaaS data because "it's in the cloud"
• Never testing restores until the day you need one
• Short retention, so an issue discovered after 30 days can't be rolled back
• Losing encryption keys or MFA recovery codes for the backup service

Backup strategy checklist

• [ ] Critical data and systems listed, with recovery point and time targets
• [ ] Three copies on two media types, one offsite
• [ ] At least one copy offline or immutable
• [ ] SaaS data (email, files, CRM, store) covered by backups or exports
• [ ] Backups encrypted; keys stored separately
• [ ] Backup admin account separate, with phishing-resistant MFA
• [ ] Retention covers at least several weeks of daily restore points
• [ ] Failure alerts on and reviewed weekly
• [ ] Restore tests completed and timed this quarter
• [ ] Plan reviewed in the last 12 months

Next steps

• List your critical systems and set recovery targets this week.
• Add a cloud-to-cloud backup for Microsoft 365 or Google Workspace, then harden the platform with how to secure Google Workspace and Microsoft 365.
• Run your first restore test and record how long it took.
• Include backups in your small business cybersecurity checklist and your data breach response plan.
• If you're preparing for investor or acquirer scrutiny, backup and recovery is a standard question in our technical due diligence reviews.

Sources

• CISA, Data Backup Options: https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf
• CISA, #StopRansomware Guide: https://www.cisa.gov/stopransomware/ransomware-guide
• WordPress Developer Resources, Hardening WordPress (data backups): https://developer.wordpress.org/advanced-administration/security/hardening/
• NIST SP 1300, CSF 2.0 Small Business Quick-Start Guide: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf
• Personal Data Protection Commissioner Malaysia, Data Breach Notification Guideline: https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/GP_DBN_ENG.pdf

Keep reading