Of all security measures, backup is the one you only notice when it is missing. While everything is fine it looks like a pointless expense; on the day ransomware encrypts your archive, a hard drive fails or someone deletes a folder by mistake, it is the only thing that matters. The 3-2-1 backup rule is the simplest way to get it right.
What is the 3-2-1 backup rule?
The 3-2-1 rule is a widely recognised good practice in IT for organising backups so that a single incident cannot destroy every copy of your data. It calls for:
- 3 copies of your data: the original plus two backup copies;
- 2 different types of storage: for example a NAS in the office and a cloud service;
- 1 off-site copy: physically away from the office, safe from theft, fire and flooding.
A more modern variant, designed specifically with ransomware in mind, is 3-2-1-1-0: one copy must be offline or immutable and restore checks must show 0 errors.
Why an always-connected external drive is not enough
Many offices back up to a USB drive plugged into a computer or to a NAS that is always reachable from the network. It is better than nothing, but it has a serious flaw: ransomware encrypts everything it can reach, backups included. In fact, attackers go looking for backups specifically so they can delete them before demanding a ransom.
That is why the #StopRansomware guide from CISA, the US cybersecurity agency, recommends backups that are offline, encrypted and regularly tested. Find out more in the article on how ransomware works in small offices.
Where to keep the copies: pros and cons
| Storage | Pros | Cons | Role in 3-2-1 |
|---|---|---|---|
| NAS in the office | Fast restore, large capacity | Reachable by ransomware if not protected; exposed to theft and fire | First local copy |
| Rotating external drive | Cheap, can be kept disconnected | Someone has to remember to plug it in and take it away | Offline copy |
| Cloud backup | Off-site, automatic | Depends on the internet connection; choose carefully where the data ends up | Off-site copy |
| Cloud with immutability (object lock) | Copies cannot be deleted for a set period | Needs more careful configuration | Immutable copy |
Note: synchronisation is not a backup. Services such as shared cloud folders also replicate deletions and encrypted files. A real backup keeps multiple versions over time.
How to organise backups in an office, step by step
- Decide what to back up: your document archive, practice management software and its database, email, software settings. Don’t forget data that lives only on laptops.
- Decide how much you can afford to lose: if the backup runs overnight, in the worst case you lose a day’s work. Some data may need more frequent backups.
- Automate: a backup that depends on someone’s memory will sooner or later be skipped.
- Encrypt the copies, especially off-site ones: backups contain the same confidential data as the original.
- Protect access to the backup system with passwords different from the office’s other passwords and with two-factor authentication.
- Keep at least one copy disconnected or immutable.
- Check the results: someone has to receive and read the “backup succeeded / failed” notification.
- Test a restore (see below).
Why backups must be tested
It is surprising how many organisations discover that their backups are unusable only when they need them: incomplete copies, corrupted files, lost encryption passwords, restore times of several days.
A simple test, to be done at least every quarter:
- pick a few files and one whole folder at random;
- restore them to a different location from the original;
- check that they open correctly;
- note the date, the outcome and the time it took.
This record is also useful evidence for GDPR purposes: Article 32 requires you to regularly test the effectiveness of your security measures (→ GDPR security measures).
Backup and GDPR: two points to watch
- Backups contain personal data: the same security and retention rules apply as for the original data.
- If you use a cloud service, check where the data is stored and that your contract with the provider governs the processing.
Is backup enough?
Backup lets you get back up and running, but it does not stop data from being stolen before it is encrypted (so-called double extortion). That is why it must go hand in hand with measures that reduce the ways in and let you notice early any unusual activity on the network, such as a computer sending large amounts of data outside. This is the job of a monitored firewall like Strega Defence, which alerts the owner in plain language when something that matters happens.
To work out where to start, try the 10-question security checklist. And if the worst has already happened, read what to do immediately after an attack.
Frequently asked questions
What does 3-2-1 backup mean?
It means keeping three copies of your data, on two different types of storage, with at least one copy kept off-site. That way a single event, such as a hardware failure, a theft or an attack, cannot destroy every copy.
Is a NAS backup enough to protect against ransomware?
Not on its own, if the NAS is always reachable from the network: ransomware can encrypt it along with the computers. You need at least one other copy that is disconnected or immutable, ideally off-site.
What is an immutable backup?
It is a copy that, once written, cannot be changed or deleted for a set period, not even by an administrator. It protects backups from the very attackers who try to wipe them before demanding a ransom.
How often should you back up?
It depends on how much data the office can afford to lose. For most offices an automatic daily backup is a good starting point, with more frequent backups for practice management software and databases that are in constant use.
Are Dropbox, OneDrive or Google Drive a backup?
Not on their own: they are synchronisation services, which also replicate deletions and encrypted files. Some keep previous versions for a limited time, but they do not replace a separate, versioned and ideally immutable backup.
How often should you test a restore?
At least once every three months and after every major change, such as new practice management software or a new NAS. Note the date, the outcome and the time it took: this is also useful evidence for GDPR purposes.
Sources and further reading
- #StopRansomware Guide — CISA, MS-ISAC, NSA, FBI.
- Regulation (EU) 2016/679 (GDPR), Article 32 — EUR-Lex.
- Consigli utili per i professionisti IT delle PMI (PDF) (in Italian) — ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale).
- Data Breach Investigations Report — Verizon, 2025 edition.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
