Backup Strategy for SMEs: Implementing the 3-2-1 Rule Correctly

A backup strategy defines which data is backed up, how often, on what media, and for how long—as well as how it can be restored in an emergency.

That final clause is the crucial one. In practice, recovery efforts rarely fail because no backup exists at all. They fail because the only copy was kept in the same room, the retention period was too short, or no one ever verified how long a full recovery would actually take.

To address precisely this, there is a rule of thumb that has proven its worth over decades: the 3-2-1 rule. It is simple enough to remember and robust enough to cover the most common failure scenarios.

This article explains the rule, its modern extension, and the various types of backups and media—and shows how these elements combine to form a strategy that holds up when it matters most.

Table of contents

• What a backup strategy must achieve
• The 3-2-1 rule explained
• The extension: 3-2-1-1-0
• Backup types: Full, differential, incremental
• Comparison of storage media
• What needs to be backed up and how often
• Defining responsibilities and oversight
• Testing recovery
• Conclusion
• FAQ Backup strategy

What a backup strategy must deliver

Backing up data is not an end in itself. It must address two questions that arise before any technical decision is made:

1. How much work can we afford to lose? The answer determines the backup frequency. If a loss of one day’s work is acceptable, a nightly backup suffices; however, if transactions are constantly being processed, multiple runs per day are required.
2. How long can the restart process take? The answer determines the storage location and the method used. A server that is essential for operations requires a fast local copy, whereas an archive drive does not.
   

These two target metrics are commonly referred to as RPO and RTO. RPO defines the maximum acceptable data loss, while RTO defines how quickly a system must be available again following a failure. A sound backup strategy translates these metrics into specific backup intervals, storage locations, and recovery procedures.

These values ​​should be defined and documented in writing for each system. They have a greater impact on costs and effort than any decision regarding specific products.

Creating a backup strategy: the key steps

A backup strategy is not created simply by selecting software; rather, it requires following a clear sequence of steps:

1. Identify critical systems and data
2. Determine the acceptable level of data loss for each system
3. Determine the maximum allowable recovery time for each system
4. Select appropriate backup methods and storage targets
5. Define retention periods and off-site storage requirements
6. Plan for protection against deletion, ransomware, and human error
7. Regularly test and document the recovery process

Only then can you make an informed decision about whether you need a local backup, cloud backup, Microsoft 365 backup, Proxmox backup, or a comprehensive solution like Veeam.

Clearly distinguishing between concepts is equally important, as three things are frequently confused:

Cloud storage is not a backup. If a file is deleted or encrypted, synchronization reliably propagates this change—meaning the original is lost there too unless true versioning is in place. The article on email archiving covers the legal requirements for archiving.

The 3-2-1 rule explained

The rule outlines a minimum standard that protects against the most common failure scenarios:

• 3 total copies of the data – the original and two backups
• 2 different media or storage systems
• 1 off-site copy, physically separated from the original

There is a specific reason for each number.

Three copies protect against the scenario where a backup itself is damaged. If the original fails and the only backup is unreadable, everything is lost. A second backup makes this situation manageable.

Two media protect against systematic errors. If both backups are stored on identical hard drives from the same manufacturer and batch, a manufacturing defect could affect both simultaneously. Similarly, a faulty backup software update would affect all backups stored in the same way.

An off-site copy is the most important element, yet it is the one most frequently overlooked. It provides protection against anything that might affect the physical site — such as fire, water damage, burglary, or electrical surges — as well as against ransomware that specifically targets accessible backup drives.

A common misconception: An external hard drive that remains permanently connected to the server does not truly satisfy any of these criteria. It is located in the same room, connected to the same system, and is just as accessible to malware as the original data.

The expansion: 3-2-1-1-0

As the threat landscape has evolved, the rule has been expanded to include two additional points:

• 1 copy kept offline or immutable — meaning it cannot be permanently overwritten
• 0 errors during backup verification

The fourth point addresses the threat of ransomware. Modern attacks often remain undetected in the network for weeks, specifically targeting and deleting backups before encryption takes place. A copy that cannot be deleted—even with administrator privileges—survives such attacks.

This can be implemented in practice in two ways: either physically separated — using a storage medium that is disconnected and locked away after the backup run — or via technical immutability, where the storage system protects backups from deletion for a defined period.

The fifth point requires that backups be regularly checked for readability. A defective backup that is only discovered during an actual emergency is not a backup at all. Some systems handle this automatically; where they do not, this check must be integrated into standard operational procedures.

The broader context regarding other layers of protection is outlined in the article on ransomware protection.

For small and medium-sized enterprises (SMEs) without an in-house IT department, the challenge rarely lies in the rule itself, but rather in ongoing operations. FIGULI CONSULTING designs backup strategies for businesses, sets up suitable solutions (such as Veeam), monitors backup runs, and verifies at regular intervals that the data can actually be restored.

Plan your backup strategy with FIGULI

Backup types: Full, differential, incremental

The choice of backup method determines the duration of a run, the amount of storage it occupies, and the speed of recovery.

The practical difference becomes apparent in a real-world scenario. With incremental backups, restoration requires the entire chain; if a single link is missing, all subsequent backup states become unusable. With differential backups, only two elements are needed: the full backup and the most recent differential backup.

Many businesses have found success with a combined approach: a weekly full backup interspersed with daily incremental runs. This keeps nightly backup runs short while limiting the chain length to one week.

Modern solutions often operate on a "full backup once, then permanently incremental" principle: after the initial full backup, only changes are transferred and merged in the background to create an up-to-date full backup state. This combines short run times with easy restoration.

Media Comparison

For most SMEs, a combination of network storage and cloud is the most pragmatic option: network storage for quick recovery in everyday life, the cloud as an off-site copy.

Changing external hard drives is a valid implementation of swapping - but only if the change actually takes place. In practice, this is the most common weak point because it depends on one person and is absent during vacation or illness.

The article on cloud backup describes how outsourcing to the cloud can be implemented.

What needs to be backed up and how often

The selection is based not on the volume of data, but on the question: Without which data would business operations come to a standstill?

Typically, this includes:

• File servers and network storage containing active working files
• Virtual machines, including their configurations
• Databases for inventory management, accounting, and industry-specific software
• Microsoft 365, including mailboxes, files, and Teams content
• Firewall, network, and server configurations
• Laptops used by staff who frequently work remotely

The last two items are the ones most often overlooked. A firewall configuration may be small in size, but reconstructing it can take days.

Two special cases warrant particular attention: Microsoft 365 is not protected by Microsoft in the sense of a data backup — the

responsibility for the content remains with the customer (see the article on Microsoft 365 backup). Virtualized environments also entail specific requirements, which are addressed in the article on Proxmox backup.

Stagger storage sensibly

The rationale behind this is that the retention period must extend beyond the time it takes to discover a problem. If database corruption is only detected after three weeks, fourteen daily backups are of no use—they already contain the error. This is precisely why weekly and monthly backups exist.

Practical advice on data backup is available on the Austrian government website onlinesicherheit.gv.at, while the Austrian Economic Chambers’ IT security handbook for SMEs offers a more comprehensive overview.

Define responsibilities and controls

A backup strategy only works if it is clear who manages it on a day-to-day basis. Therefore, responsibilities should be defined in writing: who monitors backup runs, who receives error notifications, who performs recovery tests, and who decides—in an emergency—which systems are restored first.

Notifications are particularly critical. A backup system that sends error alerts to an unread inbox offers the company virtually no protection. Clear escalation paths are essential: errors must be detected, assessed, and resolved before the backup is actually needed in an emergency.

For SMEs without an in-house IT department, this ongoing management is often more challenging than the initial technical setup. This is precisely where the biggest difference lies between simply having a backup in place and having a robust backup strategy.

Test recovery

A backup from which nothing has ever been restored is an assumption, not a backup.

In practice, restores rarely fail due to missing data. More common are: An important system was never included in the backup job. The backup had been running with errors for months without anyone reading the messages. The process takes three times as long as expected. Or no one knows in which order systems have to come back.

A sustainable testing rhythm:

• Retrieve a single file monthly
• restore a full system annually
• record duration and result each time

Comparing the actual duration with the planned target value is where the actual knowledge is gained. It regularly deviates significantly - and only those who know this in advance can communicate realistically in an emergency.

A fixed order of restarting is just as important: Which system has to run first so that work can be done at all?

This order belongs on paper, not in a file on the failed server.

And finally: someone has to actually see the error messages. A security system whose warnings end up in an unread mailbox is practically non-existent.

Conclusion

The 3-2-1 rule has endured because of its simplicity: three copies, two media types, one off-site. It covers the most common failure scenarios without requiring you to read through a complex strategy document.

When supplemented with two modern elements — an immutable copy and regular error checks — it holds up against today’s threat landscape, where attackers deliberately delete backups before encrypting data.

Yet the most important step remains the least spectacular one: actually testing the recovery process. In a crisis, the deciding factor isn't "Do we have a backup?" but rather "How long will it take to get back to work?"—and the only way to know that answer is to have measured it.

FIGULI CONSULTING helps SMEs develop a suitable backup strategy, monitor operations, and make the recovery process predictable.

Discuss your backup strategy with FIGULI

FAQ Backup Strategy

What is the 3-2-1 rule?

Three copies of the data—the original and two backups—stored on two different media or storage systems, with one copy kept at a separate off-site location. This covers the most common failure scenarios: a faulty backup, a systematic media failure, and site-specific damage.

What does 3-2-1-1-0 mean?

An extension of the classic rule. The fourth digit represents a copy stored offline or in an immutable format that cannot be deleted, even with administrator privileges. The fifth digit requires that backups be regularly checked for readability and verified to be error-free.

What is the difference between full, differential, and incremental backups?

A full backup captures all data. A differential backup captures all changes made since the last full backup, whereas an incremental backup captures only the changes made since the last run. Incremental backups are the most storage-efficient but require the complete chain of all runs for restoration.

Is cloud storage like OneDrive a backup strategy?

No. Cloud storage synchronizes data across devices, propagating deletions and encryption in the process. Without true versioning and a controlled restoration process, it is synchronization, not a backup.

How long should backups be retained?

A tiered approach has proven effective: daily backups kept for one to two weeks, weekly backups for four to six weeks, and monthly backups for six to twelve months. Crucially, the retention period must exceed the time it takes to discover a latent issue.

How often should restoration be tested?

Test a single file monthly and a full system annually—documenting the duration and result of each test. Successful backup notifications alone do not prove that the data can actually be restored.

Is an external hard drive connected to the server sufficient?

No. A permanently connected hard drive is located at the same site, is connected to the same system, and is just as accessible to malware as the original data. It meets neither the requirement for physical separation nor that for an immutable copy.

What should a backup strategy include?

A backup strategy should define which data and systems are backed up, the frequency of backups, where they are stored, how long they are retained, who monitors the process, and how recovery is tested. Protection against ransomware, an off-site copy, and clearly defined responsibilities in the event of an emergency are also important.

Note:

This article provides general information on data backup in a business context. The specific backup types, intervals, and retention periods suitable for a given situation depend on the system landscape, data volume, availability requirements, and legal retention obligations; these should be professionally assessed.