Ask any IT professional how to back up business data and you’ll probably hear about the “3-2-1 rule”. It’s a simple formula that has protected businesses from hardware failure, theft, fire and, more recently, ransomware.
This guide explains the 3-2-1 backup rule for small businesses, how to apply it in a typical Singapore office, and the newer 3-2-1-1-0 version designed for ransomware.
What Is the 3-2-1 Backup Rule?
- 3 copies of your data: the original plus two backups.
- 2 different types of storage: for example, a local backup device and cloud storage, so one type of failure can’t take out everything.
- 1 copy off-site: stored away from your office, so a fire, flood, theft or office-wide ransomware infection doesn’t destroy every copy.
The rule is usually credited to photographer Peter Krogh, who described it in the mid-2000s for protecting digital photos. It caught on because it is easy to remember and works for any size of organisation.
Why It Matters for Small Businesses
- Hardware fails. Hard disks and servers do eventually die, often without warning.
- People make mistakes. Files get deleted or overwritten, and sometimes nobody notices for weeks.
- Ransomware targets backups. Attackers look for backup drives and shared folders on your network and encrypt them too.
- Laptops get lost or stolen. Data that lives only on one device is at risk.
- Cloud apps aren’t automatically backed up. Microsoft 365, for example, keeps your data available, but deleted or encrypted items can be lost once retention periods pass.
CSA’s Cyber Essentials, the baseline cybersecurity standard for Singapore organisations, requires businesses to back up business-critical data and systems, and to store backups “separately and isolated from the operating environment”. It also recommends testing backups at least twice a year.
What 3-2-1 Looks Like in a Typical Office
| Copy | Where | Example |
|---|---|---|
| 1. Original | Where you work | Accounting files on your server, documents in Microsoft 365, files on staff laptops |
| 2. Local backup | A separate device in the office | Backup appliance or NAS, for fast restores of individual files or a whole server |
| 3. Off-site backup | Cloud backup | Encrypted copy in a secure data centre, for disasters and ransomware |
For most SMEs, the simplest way to meet 3-2-1 is a backup service that automatically keeps a local copy and a cloud copy, managed from one place. That way nobody has to remember to swap drives or take a disk home.
The Modern Version: 3-2-1-1-0
Because ransomware now deliberately hunts for backups, many IT providers recommend an extended version:
- 3-2-1 as above, plus
- 1 copy offline, air-gapped or immutable: a copy that can’t be changed or deleted, even by someone with admin passwords, for a set period.
- 0 errors: backups are checked automatically and restores are tested, so you know they will work when you need them.
The “0” is the step most often skipped. A backup you’ve never tested is only a hope. Set a reminder to do a test restore, for example one folder, one mailbox or one server, at least every six months.
Common Backup Mistakes to Avoid
- Relying on a USB drive left plugged in. If ransomware can see it, it can encrypt it.
- Treating file sync as backup. OneDrive, Dropbox and Google Drive sync deletions and encrypted files too. Version history helps, but it isn’t a full, independent backup.
- Forgetting Microsoft 365. Email, OneDrive, SharePoint and Teams need their own backup.
- Backing up files but not systems. Restoring a whole server or accounting system from files alone can take days.
- No one checking. Backups silently fail when disks fill up or passwords change.
A Simple 3-2-1 Checklist
- List your business-critical data: accounting, customer records, email, shared files, line-of-business systems.
- Decide how much data you could afford to lose (an hour? a day?) and set backup frequency to match.
- Keep one local backup for quick restores and one off-site or cloud backup.
- Make sure at least one copy is immutable or offline.
- Protect backups with strong passwords, encryption and MFA.
- Test a restore at least twice a year, and after any big change.
- Write down who to call and how to restore, and keep it somewhere you can reach if your systems are down.
How Ostendo Helps
Acronis Backup gives Singapore SMEs automatic local and cloud backups for servers, PCs and Macs, with immutable storage options and centralised monitoring. Microsoft 365 Backup covers email, OneDrive, SharePoint and Teams. We set it up, monitor it and help you test restores, as part of our IT support.
Acronis Backup and Microsoft 365 Backup are Pre-Approved Solutions under IMDA’s SMEs Go Digital programme, so eligible SMEs can get up to 50% grant support. See our EDGE grant guide for details.
Frequently Asked Questions
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage, with one copy off-site. It protects you from hardware failure, mistakes, disasters and ransomware.
Is cloud backup enough on its own?
Cloud backup gives you the off-site copy. A local copy as well means faster restores, which is why 3-2-1 combines both.
Is OneDrive or Google Drive a backup?
Not really. They sync files, including deletions and encrypted files. Version history helps, but a separate backup gives you independent copies you control.
How often should a small business back up?
Match it to how much data you could afford to lose. Many SMEs back up servers and key systems daily or more often, and test restores at least twice a year as CSA recommends.
What does immutable backup mean?
A backup copy that can’t be changed or deleted for a set period, even by an administrator. It protects backups from ransomware and malicious insiders.
Check Your Backups
Not sure whether your business follows the 3-2-1 rule? WhatsApp Ostendo on +65 9457 3538 and we’ll review your current setup.
