What the rule says
The rule has three numbers. Each one protects against a different kind of loss.
Three copies. This means the file you work on, plus two backups. The working file counts as the first copy. A single backup is one bad day away from being no backup at all.
Two media types. The copies should not all sit on the same kind of storage. For example, one backup on an external drive and one in a cloud service. A fault that hits one kind of storage is unlikely to hit the other.
One copy offsite. At least one backup should be outside your office. A fire, a flood or a break-in can take out the computer and the drive sitting next to it.
The United States Computer Emergency Readiness Team (US-CERT) put this rule in a plain paper called Data Backup Options. The paper tells readers to follow the 3-2-1 rule whichever backup option they pick.
Why one backup is not enough
Business files disappear for plain reasons. Someone steals a laptop. A staff member deletes a folder by mistake. A drive fails. Ransomware locks every file it can reach.
That last case is the one that changes the rule of thumb. If a backup drive is plugged in all day, the same malware may lock it too. The Australian Signals Directorate (ASD) says regular backups help a business recover and keep operating after an incident such as ransomware. Its small business guide also recommends an offline backup, and it says to disconnect the backup device from the network and store it somewhere secure, such as a safe.
ASD adds that people without administrator rights should only reach their own backups. They should not be able to change or delete them. In a small office, that means the backup login is not the one everyone uses to read email.
What it looks like in a small office
Take a ten-person firm with files on a shared server. Copy one is the live data on that server. Copy two is a nightly backup to a drive that is kept offline. Copy three is an encrypted cloud backup, held at a different location.
That gives three copies. It uses two kinds of storage, a drive and the cloud. One copy is offsite. The rule is met.
Now count a weaker setup. A business has a laptop, an external drive on the desk, and a second folder on the same drive. That looks like three copies. In truth it is one laptop and one drive, in one room. It fails the media test and the offsite test.
Software as a service needs the same thought. Files held in Microsoft 365 are in the cloud, but that does not make them a backup. ASD says the built-in recycle bin and versioning tools are not enough to recover from many incidents, for example when an administrator account is taken over. Its advice is to use a separate third-party backup product.
How to ask your IT provider to prove restores work
A backup you have never restored is a hope, not a backup. ASD tells businesses to test restores from backups ahead of an incident, so that problems and dependencies show up before they matter. Use these questions with your provider.
- Where are the three copies, and what kind of storage holds each one?
- Which copy is offsite, and which copy is offline or cannot be changed from the main network?
- When did you last restore a file, a folder and a whole system from backup? Can I see the record?
- How long did the restore take, and is that time acceptable to us?
- Who can delete or change the backups? Is that login separate from daily staff logins?
- How many days of work would we lose if today's data were gone?
The last question matters most. ASD suggests that a business decide how many days of work it is willing to lose, then set the backup schedule to match. That turns a technical choice into a business one.
Ask to watch a test. Pick a file at random, ask for it back from the offsite copy, and time it. A provider with a real process will do this without fuss. Ask for the result in writing and keep it with your vendor records.
What the rule does not cover
The rule counts copies. It does not say how fresh they are, how long they are kept, or whether staff can reach them. ASD says backups should be kept for a time that fits the business, and that they should be saved so the business can restore to a common point in time. Several systems restored from different days can leave a business with records that do not match.
The rule also says nothing about privacy. A backup holds the same customer data as the live system, so it needs the same care. Encrypt it, and keep the storage physically secure. US-CERT makes this point for cloud storage and for portable media.
Finally, ASD asks businesses to know what data they hold and what it is worth. Start there. Back up the data that would stop the business if it vanished. Put the less important data on a lighter schedule.
The limit of this check: a provider can pass every question on paper and still fail on the day. Only a recent, timed restore shows that the backups work.