# The 3-2-1 Backup Rule for Small Businesses, Explained

Source: https://dijitulsupport.co.uk/guides/3-2-1-backup-rule-small-business/
Updated: 2026-10-10

> The 3-2-1 backup rule means keeping three copies of your data, on two different types of storage, with one copy off site. For ransomware protection, make one copy immutable or offline and test restores regularly. dijitul sets up and checks backups for UK small businesses, with daily website backups included in plans from £25 a month + VAT.

## Key facts

- 3 copies: the live data plus two backups
- 2 types of storage: for example a NAS in the office and a cloud backup service
- 1 copy off site, so fire, theft or flood does not take every copy
- The 3-2-1-1-0 version adds one immutable or offline copy and zero errors on test restores
- Sync services such as OneDrive copy deletions and ransomware encryption, so they are not a backup on their own
- The UK Government's Cyber Security Breaches Survey 2025/26 found 74% of businesses back up data to the cloud
- dijitul's plans from £25 a month + VAT include daily website backups

## What 3-2-1 means

- **3 copies of your data.** The original plus two backups. One backup can fail; two failing at the same time is far less likely.
- **2 different types of storage.** For example, a NAS drive in the office and a cloud backup service. If one type has a fault, the other is unaffected.
- **1 copy off site.** A fire, flood or burglary at the office should not take every copy with it.

The rule is old, but it still works because it protects against the real causes of data loss: hardware failure, accidental deletion, theft, and ransomware.

## The modern version: 3-2-1-1-0

Ransomware changed the picture. Attackers now look for backups and encrypt or delete them first. Any backup the attacker can reach with a stolen admin password is at risk. That is why many IT teams now use **3-2-1-1-0**:

- **1 immutable or offline copy**: a backup that cannot be changed or deleted for a set period, even by an administrator, or a drive that is physically disconnected.
- **0 errors**: backups are checked and test restores are done, so you know they actually work.

A backup you have never restored is only a hope. Test a file restore every month and a full restore at least once a year.

## Applying it to a small business

| Data | Common mistake | 3-2-1 approach |

| PC and laptop files | Files only on the desktop | Save to OneDrive or SharePoint, plus a separate backup of that cloud data |
| Microsoft 365 email and files | Assuming Microsoft keeps backups for you | Third-party Microsoft 365 backup with its own retention |
| Office server or NAS | A USB drive left permanently plugged in | Local backup plus an immutable cloud copy |
| Website | Backups stored on the same server | Daily backups stored off the server, with older copies kept |
| Accounts software | Desktop data files never backed up | Included in PC or server backup, or a cloud package |

The UK Government's Cyber Security Breaches Survey 2025/26 found 74% of businesses back up data to the cloud. That is a good start, but cloud storage alone is not 3-2-1.

## Why OneDrive and Microsoft 365 are not enough on their own

OneDrive, SharePoint and Dropbox are sync services. If ransomware encrypts files on a PC, the encrypted versions sync to the cloud. If someone deletes a folder, the deletion syncs too. Recycle bins and version history help, but they have time limits and they sit inside the same account an attacker may control. Microsoft 365 is built to keep the service running, not to keep long-term copies of your data in a separate place. A dedicated Microsoft 365 backup gives you an independent copy with your own retention period.

The same applies to websites: a host's own snapshots are useful, but if the hosting account is suspended, hacked or closed, those copies can disappear with it.

## A simple checklist

- List what data you hold and where it lives.
- Decide how much you could afford to lose: a day, an hour?
- Choose two storage types and one off-site location.
- Make at least one copy immutable or offline.
- Protect backup logins with separate passwords and MFA.
- Get alerts when a backup fails.
- Test restores on a schedule and write down the steps.

Keep the written restore steps somewhere you can reach if the office systems are down, such as a printed copy or a personal device. In a real incident, nobody wants to be searching a locked server for instructions on how to unlock it.

## When to call dijitul

Call us if you are not sure what is backed up, if your only backup is a USB drive, or if you have never tested a restore. We review your set-up, design a 3-2-1 approach that fits your budget and test it. Our plans from £25 a month + VAT include daily website backups; office and Microsoft 365 backups are set up at £45 an hour + VAT or quoted for bigger jobs. See data backup and recovery and website backups. If you have already been hit, see ransomware recovery.

## FAQs

### What is the 3-2-1 backup rule?

Keep three copies of your data, on two different types of storage, with one copy off site. For example: files on your PCs and server, a backup on a NAS in the office, and a backup in a cloud service. It protects against hardware failure, deletion, theft and disaster.

### Is OneDrive a backup?

Not on its own. OneDrive syncs files, so deletions and ransomware-encrypted files can sync to the cloud. Version history and the recycle bin help but have limits and sit in the same account. A separate backup of your Microsoft 365 data gives a true independent copy.

### What is 3-2-1-1-0?

An updated version of the 3-2-1 rule. It adds one immutable or offline copy that ransomware or a rogue admin cannot alter, and zero errors, meaning backups are verified and restores tested. It reflects how attackers now target backups before encrypting data.

### How often should a small business back up?

At least daily for most business data, and more often for systems that change constantly, such as accounts or ecommerce orders. Ask how much work you could afford to redo. dijitul's website plans include daily backups, from £25 a month + VAT.

### How often should I test my backups?

Test restoring a few files monthly and do a full restore test at least once a year, or after major changes. Many businesses discover backups were failing only when they need them. Backup alerts plus regular test restores catch this early.

### Can dijitul set up backups for my office?

Yes. dijitul reviews what data you hold, recommends a 3-2-1 approach for PCs, servers, Microsoft 365 and your website, sets it up and tests restores. Set-up is £45 an hour + VAT, and larger projects are quoted. Most work is done remotely.

## Pricing and contact

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Plans: Essential £25/month + VAT (Website software updates (core, plugins, themes) applied and checked, Daily backups, Uptime monitoring, Security monitoring); Business £50/month + VAT (Everything in Essential, 1 hour of fixes or changes every month, Priority support); Complete £99/month + VAT (Everything in Business, 3 hours of fixes or changes every month, IT and Microsoft 365 helpdesk for your team). Ad-hoc support is £45 an hour + VAT. The first 30 minutes are the minimum charge, then we bill in 15-minute blocks. Contact: 01623 650333, support@dijitul.uk, https://dijitulsupport.co.uk/contact/