The 3-2-1 back-up rule explained (and why OneDrive is not a back-up)

Almost every business owner we talk to says the same thing: 'Our files are in OneDrive, so we have a back-up.' Understandable, but wrong. Synchronisation and back-up look alike, but they protect against different things. You only notice the difference on the day you need something back, and that is a bad moment to find out. Below: why synchronisation is not a back-up, what the 3-2-1 rule means and how you test whether your back-up actually works.

Why OneDrive is not a back-up

OneDrive, Google Drive and Dropbox do exactly what they promise: a file has the same version on all your devices. Handy for working together, but it means every change is applied everywhere. Including the changes you would rather not have had.

• Delete a folder by accident and within seconds it is gone from the cloud and from your colleague's laptop as well. The synchronisation is simply doing its job.
• If ransomware encrypts the files on one workstation, the encrypted versions are neatly synchronised to everyone.
• The recycle bin and version history help, but only within a limited period and file by file. If you notice a problem only after weeks, or have to restore thousands of files, they will not get you far.

A back-up is something else: a separate copy, in a separate place, that does not change along with whatever happens on your workstations. That distance lets you go back to a moment before the mistake. How to tell whether something has already gone wrong is covered in Has my company already been hacked?.

The 3-2-1 rule in plain language

The 3-2-1 rule is an old rule of thumb that still holds up: simple to remember, strict enough for most disasters.

• Three copies of your data: the version you work with, plus two back-ups. One back-up is no back-up, because back-ups break too.
• Two types of media: for example a NAS in your office and a cloud back-up. If one type fails through a defect or a software bug, the other remains.
• One copy off-site: at another location, offline or immutable. Fire, theft or ransomware that reaches your whole network must not be able to touch that last copy.

That last point is the most important one today. Ransomware actively looks for back-ups reachable over the network and encrypts those first. A copy that nobody can modify or delete, not even an administrator, is your real safety net. Ask your supplier for an 'immutable' back-up.

What do you back up, how often and for how long?

A company of fifteen people rarely has a server room anymore, but it does have a surprising number of places where data lives:

• Microsoft 365 or Google Workspace: mailboxes, SharePoint, Teams and OneDrive. Microsoft and Google store your data, but do not protect you against your own deletions or a hijacked account. Separate back-up software exists for that.
• Accounting and ERP: if it runs locally, the database belongs in the back-up. In the cloud? Ask your supplier what they keep and how you get an export.
• Server or NAS: everything shared on it. A NAS is a good first back-up location, but it can fail too.
• Workstations of key people: the laptop of the owner or the bookkeeper often holds files that never made it to the shared drive.
• Your website or webshop: files and database, separate from whatever your hosting company promises.

How often and for how long depends on two business questions you can answer better than your IT person. How much work can you afford to lose? If your back-up runs every night and a problem hits at 4 pm, you lose a working day. How long can you be down? Restoring large volumes from the cloud can take hours to days; if that is too long, you also need a fast local copy. And because ransomware is sometimes only noticed weeks later, you also want weekly and monthly restore points, not just the latest version. Write those answers down: they are the agreements your IT partner needs.

The test question: when did you last restore something?

This is where a cyber scan usually goes quiet. A back-up that runs is not the same as a back-up that works. We see back-ups that have been hitting an error for months without anyone reading the notification, and back-ups missing precisely the most important folder. A small test plan is enough:

1. Every quarter, restore one file and one complete folder to a different location. Check that everything is there and that it opens.
2. Once a year, restore a full mailbox or workstation, preferably onto a test device. Time how long it takes and compare it with what you considered acceptable.
3. Check who receives the notifications from the back-up software and whether they are read. A mailbox nobody opens is not monitoring.
4. Note the date, the result and who did it. Those notes are worth their weight in gold for your cyber insurance and NIS2.

What does it cost in time, and what does an IT partner do?

One-off: half a day to make the inventory, record the agreements and set up the back-up. After that, a couple of hours per quarter for the tests and the notifications. As an IT partner we take that work off your hands and turn it into a routine: monitor the back-ups daily, schedule and document the restore tests, and adjust the setup as your company changes. What we mainly add is not the software, but the certainty that someone is looking at it.