Ask SMEs about their backup and you often hear: “We have an external hard drive.” That is better than nothing – but in case of fire, theft or ransomware, that drive is usually affected too. The 3-2-1 rule has been the proven standard for years to prevent exactly that.
What the rule says
- 3 copies of your data: the original plus two backups.
- 2 different storage media, for example a backup server and a NAS or tape.
- 1 copy off site, for example in a data centre.
That way at least one copy always remains, whether a device breaks, the office burns down or someone accidentally deletes a folder.
The modern extension: 3-2-1-1-0
Because ransomware specifically targets backups, the rule is often extended today:
- +1 immutable copy that cannot be deleted or changed for a defined period – not even with administrator rights.
- 0 errors when restoring: backups are tested regularly so they work when it counts.
What it looks like in practice
- Local backup on a separate backup server on site – for quick recovery of individual files or entire servers.
- Second copy on another system, for example a NAS with snapshots.
- Off-site copy, encrypted, in a Swiss data centre, with immutability.
- Automatic verification after every backup and regular test restores with documented results.
How often should you back up?
The key question is: how much work can you afford to lose at most? For most SMEs, a daily backup is the minimum. For accounting or ERP databases, several backups a day are worthwhile.
Conclusion
A good backup strategy is the cheapest insurance against total failure. We plan and run your backup according to 3-2-1-1-0 – with data in Switzerland. More under backup & recovery.
Frequently asked questions
Is cloud storage like OneDrive enough as a backup?
No. Sync services also propagate deletions and encrypted files immediately. They don’t replace a backup with versions and immutable copies.
How long should backups be kept?
Common practice is daily versions for a few weeks and monthly versions for a year. For business records, the statutory retention period of ten years also applies.
How often should recovery be tested?
At least quarterly for individual files and once a year for a complete server. A record documenting the test is important.
