Backing up small-office data with the 3-2-1 rule: enough, without the overhead

A failed hard drive, a lost laptop, a staff member who deletes the wrong folder, a machine hit by ransomware — sooner or later every small office runs into one of these. When it happens, what matters is not which software you use but whether you still have an intact copy. This article pulls together public guidance (Microsoft, Google, the UK's NCSC, Backblaze) and advice shared by the sysadmin community into a simple approach that works for an office of a few to a few dozen people.

What the 3-2-1 rule says

The 3-2-1 rule is the easiest way to check whether your data is actually safe:

• 3 copies: the original you work on, plus two backups.
• 2 different devices: for example the computer and an external drive or NAS. Two copies on the same disk fail together.
• 1 copy elsewhere: one copy lives outside the office — in a cloud service or on a drive someone takes home — so a fire, theft or flood can't take everything.

Backblaze points out that the rule dates back to the late 2000s and still holds today. Because ransomware increasingly goes after network-connected backups too, many people add the 3-2-1-1-0 variant: one extra copy that is offline or immutable, and zero errors when you test restores. For a small office, simply doing 3-2-1 properly — with one copy that is genuinely not plugged in all the time — is already a big step forward.

What to back up

The NCSC's guide for small organisations suggests starting with one question: which data would stop the business if it disappeared? Usually that means:

• Accounting records, invoices, contracts, payroll.
• Project files, quotes and the templates you use every day.
• Customer contacts, important email, calendars.
• Data from software installed on your machines (locally run accounting or point-of-sale software) — easy to forget because it doesn't live in Documents. Ask the vendor where the data file is stored and how they recommend backing it up.
• Your website content, if you manage it yourself.

You don't need to back up the whole C: drive. The operating system and applications can be reinstalled; your data can't be recreated.

Sync is not backup

This is the most common mix-up. OneDrive, Google Drive and Dropbox are sync services: edit, delete or encrypt a file on your computer and that change is pushed to the cloud and to your other devices within seconds. That is great for working together and means a broken laptop doesn't cost you your files, but it copies mistakes too.

OneDrive version history pane with the option to restore an older version

These services do have safety nets, and it pays to know their limits (figures from the official help pages; check them again, as they can change):

• OneDrive: file version history is kept for 30 days; the recycle bin keeps deleted items for 30 days on personal accounts and 93 days on work or school accounts (admins can change this). Microsoft 365 subscribers also get Restore your OneDrive, which rolls the whole OneDrive back to a point within the last 30 days, including after malware damage. Note that on work accounts an admin may have turned versioning off.
• Google Drive: files in the trash are deleted forever after 30 days. On Google Workspace, an admin can still recover items for 25 days after a user empties the trash; after that they are gone.

The catch: if you notice a problem after those windows close, or an attacker takes over the account and wipes it, the safety net is gone as well. In 2023, SafeBreach researcher Or Yair showed at Black Hat a technique that abused the OneDrive app itself to encrypt files and remove older versions; according to The Register, Microsoft patched those specific issues. The lesson isn't "OneDrive is unsafe" — it's that your sync cloud shouldn't be the only copy outside the machine.

On sysadmin forums, the advice repeated most often is: use sync to get work done, but keep at least one separate backup — its own schedule, its own account, and not changed in real time.

Where to keep backups: external drive, NAS, cloud or backup software

• External hard drive: the simplest option. The key point from the NCSC is don't leave the drive connected when you're not using it, because malware on the computer will encrypt every attached drive. Rotate two drives and keep one outside the office, and you have your off-site copy.
• NAS (network storage): convenient for backing up several machines automatically. But a NAS is always on the network, so it's a ransomware target too. Turn on snapshots if your NAS supports them, use a dedicated account for backups (not one staff use every day), and still keep a copy somewhere other than the NAS.
• Cloud backup service (as opposed to sync): runs on a schedule, keeps many versions and often lets you lock data against deletion for a period. It's a common way to get the off-site copy without carrying drives home.
• Backup software: Windows and macOS both ship with built-in tools (File History, Time Machine). On the Tom's Guide forums, a moderator suggested free tools such as FreeFileSync or SyncBackFree to automatically copy OneDrive/Google Drive folders to a drive in the office outside working hours. Any tool is fine as long as it runs automatically, keeps multiple versions and you know how to get data back out.

Whatever you choose, turn on two-step verification for every cloud account that holds backups — the NCSC stresses this.

Staff laptops

Laptops are where data is lost most easily: they travel, get dropped or stolen, and people save everything to the Desktop.

OneDrive dialog offering to back up the Documents, Pictures and Desktop folders

• Move familiar folders to the cloud: with Microsoft 365, an admin can use Known Folder Move to redirect staff Desktop, Documents and Pictures into OneDrive — people save files as they always have, but there's now a cloud copy. Microsoft notes that configuring these policies takes some admin experience. Google Workspace offers Google Drive for desktop for a similar setup.
• Set a rule for where work goes: work data lives only in synced folders, not scattered on a D: drive or USB sticks.
• When someone leaves: hand their data over to someone else before deleting the account. Deleting an account usually takes the files in that person's OneDrive or Drive with it.

Once laptop data is in OneDrive or Google Drive, it should still be included in the separate backup described above.

Test restores — the step most people skip

A backup you have never restored from is a backup you can't be sure of. The NCSC advises knowing how to restore and checking that the backup contains all your important data. Once a month:

• Pick a few files at random, restore them to a different folder and open them.
• Once a quarter, restore a large folder or your accounting software's data onto another machine.
• Note how long it took and what went wrong. When a real incident hits, you'll know how long it takes to get back to work.

A simple weekly routine

A basic schedule for whoever looks after IT on the side:

• Daily (automatic): backup software runs after hours and copies important data to the NAS or external drive.
• Friday: check the backup report — did the last run succeed, did the size jump unexpectedly?
• Friday: plug in the rotation drive, run the weekly copy, unplug it and take it off-site; bring last week's drive back.
• Weekly: confirm the cloud backup is still running and the account still has two-step verification on.
• Monthly: do a test restore of a few files as described above.
• When someone joins or leaves: review which folders are backed up and which laptops have sync turned on.

You don't have to get it perfect on day one. Start with one external drive that isn't permanently plugged in and one test restore — those two things alone cover most everyday data-loss situations.

Frequently asked questions

Is OneDrive or Google Drive a backup?

Not really. They are sync services: edit, delete or encrypt a file on your computer and the change reaches the cloud within seconds. Keep at least one separate backup — its own schedule, its own account, and not changed in real time.

What is the 3-2-1 rule?

Three copies of your data (the original plus two backups), on two different devices, with one copy kept outside the office.

How often should we test restores?

Once a month, restore a few random files to a different folder and open them; once a quarter, restore a large folder or your accounting software's data onto another machine.