Business backups: the 3-2-1 rule
A failed disk, a stolen laptop, ransomware or an accidental deletion: sooner or later every business needs to recover data. What matters then is having a backup that works.
The 3-2-1 rule
- 3 copies of your data: the original plus two copies.
- 2 different media: for example a NAS and an external drive or a cloud service.
- 1 copy off-site, so a fire, flood or theft doesn't take everything.
Today there's one more recommendation: at least one copy should be immutable or offline, meaning it can't be deleted or encrypted from the network, so it survives ransomware.
What to back up
- Working files and shared folders.
- Application databases: CRM, invoicing, private cloud.
- Email, if your provider doesn't already protect it.
- Device configurations: router, firewall, home automation, camera recorder.
Common mistakes
- Mistaking RAID for a backup: RAID protects against a disk failure, not deletion or ransomware.
- Syncing isn't backing up: delete a file in a synced folder and it's deleted in the cloud too.
- Never testing a restore: you don't know an untested backup works.
- Backups that depend on someone: the external drive you plug in "when I remember".
How we approach it
Automatic, scheduled backups, alerts if one fails, a copy kept off the premises and regular restore tests. All documented, so you know what's backed up, where and for how long.
RPO and RTO: two questions before you choose
- How much data can you afford to lose? That's the recovery point objective (RPO). If the answer is "a day", a daily backup is enough; if it's "an hour", you need more frequent backups.
- How long can you afford to be down? That's the recovery time objective (RTO). Restoring a file isn't the same as bringing back a whole server.
The answers determine the type of backup and its cost.
Types of backup
- Full: copies everything each time. Simple to restore, but takes a lot of space.
- Incremental: only what has changed since the last backup. Fast and light.
- Versioned: lets you go back days or weeks, essential if ransomware or a mistake goes unnoticed for a while.
- System image: copies the whole machine so it can be restored exactly as it was.
What about data in the cloud?
Email or documents being in a cloud service doesn't mean they're backed up. Many providers guarantee the service is available, not that deleted items can be recovered. It's wise to keep an independent copy of that data too.
Encryption and safekeeping
- Backups that leave the office should be encrypted.
- The encryption key must be stored somewhere safe and separate: without it, the backup is useless.
- Define how long backups are kept, with data protection in mind too.
A sensible schedule
- Daily: automatic incremental backup and a check that it completed.
- Weekly: an off-site copy.
- Quarterly: a real restore test of several files and one full system.
- Yearly: review what is being backed up, because the business changes.
Quick checklist
- Do you know where all your backups are?
- When was one last tested?
- Is there a copy ransomware couldn't reach?
- Are you alerted if a backup fails?
Frequently asked questions
How often should I back up?
It depends on how much work you can afford to lose. For most businesses an automatic daily backup is the reasonable minimum; data that changes constantly is backed up more often.
Is an external drive enough?
It's better than nothing, but it relies on someone plugging it in, it can fail, and if it's always connected ransomware will encrypt it too. It should be one piece of the plan, not the only copy.
How long should backups be kept?
It depends on the type of data and your obligations. A common approach combines frequent recent copies with some monthly and yearly ones; check with your adviser for documents with legal retention periods.
Connect · Protect · Automate · Control
Tell us about your project
We look at what you need and propose a complete solution: one company, one point of contact, one project.
- Phone+376 356 249
- Emailinfo@knxandorra.com