The 3-2-1 backup rule: what it means and how to implement it in your business

The 3-2-1 rule is the simplest and most effective principle in data protection. It doesn't require expensive technology or advanced expertise — just a clear strategy for where and how you store your backup copies. And yet most small businesses in Romania don't apply it.

What each number means

3 — three copies of your data. Not one, not two. The original plus two backup copies. Why three? Because any combination of two can fail at the same time: a hard drive dies just as you're using it to restore another one that has already failed.

2 — on two different types of media. Not two identical hard drives connected to the same computer. Different types means a local NAS and a cloud service, or a NAS and magnetic tape. Diversifying reduces the risk of a common hardware or software failure.

1 — at least one copy away from the office (offsite). This is the part most often ignored. A fire, a flood or a physical theft can destroy everything in the office — including the NAS and the USB backup on the desk. An offsite copy (in the cloud or at another physical location) survives any local disaster.

Why a single copy isn't enough

The most common mistake we see at new clients is a single copy — usually on an external hard drive connected to the computer, or on OneDrive. Here's why that isn't enough:

• A permanently connected external hard drive gets encrypted by ransomware just like the original data
• OneDrive also syncs corrupted or accidentally deleted versions — it isn't a backup, it's a mirror
• If the backup and the original are in the same office, a single physical event can destroy both
• A single copy offers no historical versions — you can't recover a file deleted three weeks ago

How to implement the 3-2-1 rule in your business

A practical implementation for an SME in Romania looks like this:

1. Copy 1 — the original data on the office computers or server
2. Copy 2 — a local Synology NAS with immutable snapshots (versions ransomware can't overwrite). Automatic daily backup, checked monthly.
3. Copy 3 — encrypted offsite cloud on Wasabi or Backblaze B2, with AES-256 encryption before upload. Reachable from anywhere, independent of the local network.

Copies 2 and 3 are on different types of media (NAS = local hardware, cloud = distributed storage) and copy 3 is offsite — the 3-2-1 rule fully covered.

Common mistakes

• Unmonitored backup. A backup that hasn't run for 3 months without you knowing doesn't protect you. Failure alerts and monthly reports are a must.
• Untested backup. The mere existence of a backup doesn't mean you can restore it. Regular restore testing is as important as the backup itself.
• Backup without versions. If every backup overwrites the previous one, you can't recover a file that was corrupted or deleted a week ago.
• All copies in the same place. Two NAS devices in the same office don't satisfy the 3-2-1 rule — that's 3 copies on 2 media, but zero offsite.