Opens in a new tab
A close-up of a keyboard with a large blue key labeled "DATA BACKUP" next to the shift key, symbolizing data security and backup.

The 3-2-1 Backup Rule for Small Businesses: Why Ransomware Turned It Into 3-2-1-1-0

By Jason Russell · October 7, 2026

Most offices I walk into have a backup of some kind: a USB drive on the server, a NAS in the closet, a Microsoft 365 setting somebody is fairly sure is turned on. The harder question is whether you could get everything back if ransomware hit tonight or a storm put water in the building, and how long it would take.

The 3-2-1 backup rule is the classic answer: three copies of your data, on two kinds of storage, with one copy somewhere else. It’s still good advice. But attackers learned that wrecking your backups first makes victims much more likely to pay, so the rule picked up two more numbers: one copy nobody can change or delete, and zero errors when you test a restore.

Below is the rule in plain English, the 3-2-1-1-0 upgrade, how it maps to a 15 to 75 person office, how often to test, what “off-site” means in Central Florida, and roughly what it costs.

What the 3-2-1 backup rule actually says

Veeam, a backup software company, defines the rule (sometimes written as the 321 backup rule) as keeping three data copies on two different media types, with one stored off-site. In plain English:

  • Three copies. Your live data counts as one, so you need two backups, not one.
  • Two kinds of storage. For example, a local backup device and the cloud. Two copies on identical hardware can fail the same way at the same time.
  • One off-site. Somewhere a fire, flood, break-in, or burst pipe at your office can’t reach.

In a typical office, the file server holds copy one, a backup device in the closet holds copy two for fast restores, and a cloud backup holds copy three in case you lose the building.

That setup handles what the rule was built for: a dead drive, a deleted folder, a stolen laptop, a fire. What it doesn’t handle on its own is an attacker who has your passwords and goes looking for your backups.

Why ransomware turned 3-2-1 into 3-2-1-1-0

CISA’s #StopRansomware Guide tells organizations to keep offline, encrypted backups and test them regularly, because “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.”

In a Sophos report from March 2024, 94% of organizations hit by ransomware said attackers tried to compromise their backups, and 57% of those attempts succeeded. Victims with compromised backups were almost twice as likely to pay the ransom (67% vs. 36%). The 2,974 respondents were IT and security professionals in 14 countries, at organizations with 100 to 5,000 employees that had been hit by ransomware in the prior year. That’s bigger than most of my readers, so treat the numbers as a direction, not a forecast.

Sophos’s State of Ransomware 2026 is more encouraging: victims recovered data from backups in 66% of attacks where data was encrypted, up from 54% in the 2025 report. That survey covered 2,158 IT and security leaders in 17 countries, at ransomware-hit organizations in the same size range. Its advice matches mine: backups “should be tested regularly, stored offline or in immutable formats,” and built into a documented incident response plan.

Veeam extended the rule to 3-2-1-1-0: the extra 1 is an immutable or air-gapped copy, and the 0 is zero errors when you verify a recovery.

What is an immutable backup?

An immutable backup is a copy that can’t be changed or deleted until a date you choose. Cloud storage providers usually call the feature Object Lock. In Backblaze’s documentation, the lock on files in compliance mode “cannot be removed by any user,” though it can be extended. That’s the point: someone holding a stolen administrator password still can’t delete those copies early.

What is an air-gapped backup?

An air-gapped backup has no live connection to your network: a disconnected drive stored off-site, or a copy in a separate system your everyday logins can’t reach. CISA calls these offline backups. Either an immutable copy or an offline copy counts as the extra 1. I find an immutable cloud copy easier to keep current than a drive someone has to remember to rotate.

The zero: restores that actually work

The 0 means zero errors when you test a restore. A backup job marked “success” tells you data was copied. It doesn’t tell you the copy opens, that the database inside it works, or that you can rebuild a server from it in time. Only a test restore tells you that.

Mapping 3-2-1-1-0 to what your office actually runs

In most offices I see, the data falls into four buckets, and each needs its own answer.

What you have Where it lives What 3-2-1-1-0 adds
Microsoft 365 or Google Workspace Microsoft’s or Google’s cloud A separate backup with its own retention
File server or NAS Your server closet A local copy for speed, plus an immutable cloud copy
Line-of-business apps An office server or the vendor’s cloud A vendor-supported backup, tested on its own
Laptops and desktops The device Work saved to backed-up storage, not the desktop

Microsoft 365 and Google Workspace

Recycle bins, sync, and version history are undo buttons, not backups. As of October 2026, Exchange Online keeps deleted items 14 days by default and 30 days at most. Work or school OneDrive files can be restored for 93 days unless an admin changed that setting, and Restore your OneDrive rolls back the last 30 days. Google Drive permanently deletes items left in the trash more than 30 days, and admins can recover items for 25 days after a user empties the trash. That’s fine for a deleted email, and not enough for a problem nobody notices for a few months. I went deeper in what really happens when you lose data in Microsoft 365 or Google Workspace.

The file server or NAS in the closet

A NAS (network attached storage, the box of drives in the closet) is a great second copy for fast restores and a poor last line of defense. If every PC in the office can write to it, ransomware running on any one of those PCs can reach it too, which is exactly the kind of accessible backup CISA warns about. Keep it for speed, keep the immutable or offline copy somewhere else, and remember that it sits in the same building as the server it protects.

Line-of-business apps

The database behind your practice management, accounting, or document management system is the piece I most often find backed up wrong, usually because everyone assumed someone else had it covered. Ask the software vendor how they want it backed up, and test a restore of that database specifically. If the vendor hosts it, ask what they back up, how long they keep it, and how you’d get your data out if you left.

Off-site means out of the storm’s path

Here’s the Central Florida version of the rule. The Atlantic hurricane season runs from June 1 to November 30, with most activity between mid-August and mid-October. A backup drive on a shelf in the office isn’t off-site. Neither is the drive the owner takes home to a house ten minutes away. One storm can flood both, cut power to both, and keep you away from both for days.

Two checks worth doing this month:

  • Look up your flood zones. FEMA’s Flood Map Service Center finds the official flood map for an address. Check the office and wherever your off-site copy lives.
  • Do the bandwidth math. Pulling 2 TB back from the cloud over a 100 Mbps connection takes about 44 hours at full speed, before any slowdowns. That’s why the local copy matters, and why your plan should say what gets restored first.

If a storm or a failed drive has already taken data, start with our page on data recovery in Orlando.

How often to test a restore

There’s no perfect number, but there are reference points. The CIS Controls, a widely used security baseline, call for testing backup recovery “quarterly, or more frequently, for a sampling of in-scope enterprise assets.” HHS tells healthcare organizations that test restorations should be periodically conducted to verify backed-up data. Here’s the cadence I suggest:

  • Weekly: someone reads the backup reports and chases every failure. A failed job nobody reads about is how backups quietly stop working.
  • Monthly: restore a few random files and one mailbox item, and confirm they open.
  • Quarterly: restore a full server or the line-of-business database to a test machine, and have someone who uses that app confirm the data is current.
  • Yearly: walk through the whole scenario. The building is unavailable on a Monday morning. What comes back first, who does it, and how long does it take?
  • After any big change: a new server, a new app, or data moved somewhere new.

Write down how long each test took. That’s your real recovery time, not the number in a sales brochure. October is Cybersecurity Awareness Month and still hurricane season, so it’s a good month to run your first one.

What it costs, roughly

Storage is the cheap part. As of October 2026, cloud object storage lists at $6.95 per TB per month on Backblaze B2 and $7.99 per TB per month on Wasabi. Both offer Object Lock (Backblaze, Wasabi), and Backblaze says there’s no extra cost to use it. Microsoft’s own add-on, Microsoft 365 Backup, lists at $0.15 per GB per month and requires a Microsoft Azure subscription.

Item (as of October 2026) List price Example
Immutable cloud storage $6.95 to $7.99 per TB per month 2 TB of server and NAS data: about $14 to $16 a month
Microsoft 365 Backup $0.15 per GB per month 500 GB of mail and files: $75 a month
Backup software, local device, monitoring, testing Varies by vendor and setup Ask to see each one itemized

Two caveats. Old versions take space, so you’ll store more than the size of your live data. And CISA says to use immutable storage with caution “as it does not meet compliance criteria for certain regulations and misconfiguration can impose significant cost.”

The bigger cost is people’s time: reading reports, fixing failures, and running the tests above.

Notes for medical, dental, law, and CPA offices

This isn’t legal advice. Your attorney, and your CPA where it applies, decides the legal and compliance questions.

Medical and dental practices

The HIPAA Security Rule requires a data backup plan to “create and maintain retrievable exact copies of electronic protected health information,” plus a disaster recovery plan to restore lost data, and it lists periodic testing of those plans as an addressable specification. HHS’s ransomware guidance adds that covered entities “should consider maintaining backups offline and unavailable from their networks.” Put imaging systems and the practice management server in your quarterly test. More on how we support medical and dental practices.

Law firms

The Florida Bar’s Ethics Opinion 12-3 says lawyers may use cloud computing if they take reasonable precautions, including making sure they have adequate access to information stored remotely. It also cites another bar’s advice to consider whether that information is stored elsewhere in case the cloud can’t be reached. Your document management and billing systems are line-of-business apps, so know where their backups live and when you last restored them. More on our work with law firms.

CPA and accounting firms

IRS Publication 4557 tells tax professionals to back up sensitive data to “a safe and secure external source not connected fulltime to a network” and to encrypt data before uploading it to the cloud. Put your tax software data and client document archive in the quarterly test; filing season is the worst time to learn a backup won’t restore. More on how we help CPA and accounting firms.

The honest tradeoffs

3-2-1-1-0 is a floor, not a guarantee. Here’s what it won’t do.

  • It won’t undo data theft. In Sophos’s 2026 survey, 16% of attacks both encrypted and stole data. Backups bring your files back; they don’t recall the stolen copies. For medical practices, HHS says patient data (ePHI) encrypted by ransomware is presumed to be a breach unless you can show a low probability that it was compromised.
  • It won’t make recovery instant. Restores take hours or days, and cloud restores move at the speed of your internet connection.
  • It only reaches back as far as your retention. If you keep 30 days of versions and the problem started 45 days ago, every copy you have is already bad.
  • Immutability can cost you. Lock a mistake in for a year, and you pay to store it for a year.
  • Testing takes staff time. That’s why it’s the first thing dropped in a busy month.
  • Backups are the last step, not the first. Stopping an attack before it spreads matters more; that’s the subject of my 5-step ransomware defense plan.

If your cyber insurance renewal asks whether backups are immutable, air-gapped, or tested, answer carefully; I covered that wording in how to answer cyber insurance renewal questions without voiding your policy. If you’re in the middle of an attack right now, go straight to our ransomware recovery page or call us.

Where I have a stake in this

Plainly: Harmony sells backup management, data recovery, and ransomware recovery. If you decide to hire someone for this work, I’d like it to be us, so weigh my advice with that in mind.

Here’s the less comfortable part. An IT provider with administrator access to your backups is one more set of keys an attacker would love to steal, and that includes us. Any provider you hire should be able to tell you in writing who can delete your backups, how long the immutable copies stay locked, and when the last restore test happened, and then show you the results. Put those questions to us, and to whoever handles your backups today.

Frequently asked questions

Does the 3-2-1 rule work?

Yes, as a floor. It covers hardware failure, accidental deletion, theft, and losing a building. Against ransomware it needs two additions: one copy attackers can’t change or delete, and regular restore tests that prove the backups work. That combination is 3-2-1-1-0.

How many backups should I have?

Keep at least three copies of anything you can’t afford to lose: the live data plus two backups. One should be off-site, far enough away that the same storm can’t reach it, and one should be immutable or offline. In practice the off-site copy is often the immutable one, which keeps the cost down.

What is the best way to back up my office computer?

Don’t keep work on the computer. Save files to the company file server, OneDrive, SharePoint, or Google Drive, and back those up separately, because sync isn’t a backup. For a computer that holds something unique, like a workstation running a local database, use an image backup of the whole machine and keep a copy off-site.

Where to start

If you don’t know when your backups were last restored, or where the off-site copy physically sits, start there. We’ll go through your current setup with you and tell you plainly what’s covered and what isn’t. No pressure, and no obligation to hire us. Harmony provides managed cybersecurity in Orlando and IT support in Orlando for offices across Central Florida. Call us at (407) 720-6540 when it suits you.

Sources

Our latest posts