Backups that actually save you: the 3-2-1 rule

Nobody thinks about backups until the morning the site is gone. A bad update, a hacked plugin, a failed disk, or simply someone deleting the wrong thing, and suddenly the only question that matters is whether you can get it all back. That is when people discover the difference between having a backup and having a backup that works.

The reassuring part is that good backup practice fits into a single short rule that has held up for decades. Get it right and a disaster becomes a quiet afternoon of restoring rather than a catastrophe.

The day you need a backup#

Data loss is rarely dramatic in the moment. It is a routine update that breaks the checkout, a member of staff overwriting a file, or ransomware quietly encrypting everything before you notice. The cause varies. The feeling, that lurch when you realise the live version is gone, is always the same.

The National Cyber Security Centre puts backups near the top of its small business guide for exactly this reason. They are the single most reliable way to recover, whatever went wrong, which is why they deserve more thought than the average business gives them.

The 3-2-1 rule explained#

The rule is easy to remember. Keep three copies of your data, on two different types of storage, with one of them kept off site. That is the whole thing, and each number is doing a specific job.

Three copies means your live data plus two backups, so a single failure never leaves you with nothing. Two types of storage means you are not relying on one technology that could share a single flaw. One off site copy means a fire, theft or flood at one location cannot take everything at once. The NCSC's specific advice on backing up your data follows the same shape, and it is worth reading alongside this.

Why on server backups protect nothing#

This is the part that catches people out. Many hosting plans store a backup on the same server as the live site. It is convenient, and for a simple mistake like an accidental deletion it can help. But it breaks the rule completely, because there is no off site copy and often no second type of storage.

Think about what an on server backup survives. If the disk fails, you lose the site and the backup together. If the server is compromised, which the ten steps to cyber security treats as a question of when rather than if, an attacker can often reach both. A backup that dies with the thing it was meant to protect is not really a backup at all. The copy that saves you is the one held somewhere separate, which is the principle behind our off site backups.

Testing the restore#

Here is the uncomfortable truth nobody likes to hear. A backup you have never restored is an assumption, not a safety net. Backups fail silently all the time. The job reports success while quietly saving an empty or corrupted file, and you only find out at the worst possible moment.

So test it. Actually perform a restore, to a staging area or a spare location, and confirm the recovered site genuinely works. Do this on a schedule, not just once. Government advice on building a more resilient business repeatedly stresses rehearsing your recovery rather than trusting it on faith. A restore you have proven is worth ten you merely hope are fine.

Automating it so you forget about it#

The best backup routine is the one you never have to think about. Manual backups depend on someone remembering, and people forget, especially when things are busy. Automation removes the human weak point entirely.

Set backups to run automatically on a sensible schedule, keep enough history that you can go back beyond a problem you did not notice straight away, and make sure at least one copy lands off site. A managed solution such as our Acronis backup handles the scheduling, the off site storage and the retention for you, so the 3-2-1 rule is simply how your data is looked after by default. Pair that with the occasional tested restore and you have turned the worst day of your business year into something thoroughly survivable.