This time, let’s talk about what a proper backup strategy actually looks like. There’s a well-known framework for this, and it’s refreshingly simple.

It’s called the 3-2-1 Backup Rule.

What Is the 3-2-1 Rule?

The concept comes from Peter Krogh, a photographer who was thinking about how to protect his life’s work. It’s since become the gold standard for data protection across every kind of business.

The rule is:

3 copies of your data 2 different types of storage 1 copy stored offsite

That’s it. Three lines. But each one matters, and most grassroots businesses aren’t following any of them.

Let’s break it down.

3 Copies of Your Data

This means the original data on your computer, plus two separate backups. Not one backup — two.

Why two? Because your single backup can fail. Hard drives die. USB sticks get lost. Cloud accounts get compromised. If you only have one backup and it’s corrupted or missing when you need it, you’re in the same position as someone with no backups at all.

The good news: copies don’t all need to be full system images. One could be an image backup of your entire machine, and the other could be a copy of your critical business files — accounting data, customer records, emails, whatever would hurt most to lose.

2 Different Types of Storage

Don’t put both backups on the same kind of device. If both backups are on external hard drives and one fails due to a manufacturing defect, the other might not be far behind — same batch, same usage, same environment.

Instead, use two different storage mediums:

• External hard drive or NAS (Network Attached Storage) at your office — for fast, local restores
• Cloud backup (Backblaze, Wasabi, Azure Blob, AWS S3) — for protection against physical disasters

The point is diversity. Different storage types fail in different ways. Cover more bases.

1 Copy Stored Offsite

This is the one most people skip. Your office has a fire, flood, theft, or power surge — and suddenly your computer and your backup drive are both gone.

An offsite copy means at least one backup lives somewhere physically separate from your business. For a small business, this doesn’t have to mean a data centre. It can mean:

• A cloud backup service (the most practical option for most)
• An external drive you rotate weekly to someone’s home
• A NAS at your house if the business is at your shop

The cloud option is honestly the easiest for a grassroots business. Once it’s set up, it runs automatically. No one has to remember to take a hard drive home on a Friday.

What This Looks Like in Practice

Let’s say you run a plumbing business with one office computer and a server.

Copy 1 (Original): Your live data on the office computer and server.

Copy 2 (Local backup): A NAS device in the office running daily backups of everything. If your server dies, you restore from the NAS. Done in minutes, not days.

Copy 3 (Offsite/Cloud): A cloud backup service running nightly, pushing encrypted backups offsite. If the office burns down, you buy a new computer, connect to the cloud, and start restoring. You’re operational again within a day or two instead of starting from scratch.

That’s the 3-2-1 rule in action. Not complicated, not expensive, but dramatically better than nothing.

What About the Cost?

This is where I expect some pushback: “Yeah, but I’m a tradie with 3 employees. I can’t afford a NAS and a cloud service.”

Here’s the thing — you can’t afford not to. A decent 2-bay NAS runs about $300-400 NZD. A 4TB external drive is around $100. Cloud backup for a small business runs about $50-100/month depending on how much data you have.

Compare that to the cost of losing all your business data. Customer records, invoices, job records, accounting files. The stuff you actually run your business on. What’s that worth?

And you don’t have to do it all at once. Start with an external drive and a cloud backup first. Add a NAS later. The key is to start.

The Bare Minimum

If budget is genuinely tight, here’s the absolute baseline:

• Copy 1: Your computer (original)
• Copy 2: External hard drive plugged in at the office, backing up weekly
• Copy 3: Cloud backup service running automatically

This costs you about $8-10/week for a basic cloud backup and possibly a one-time cost for an external drive. Less than most people spend on coffee.

If that’s still too much, I’d challenge you to think about what your business data is worth. Because the question isn’t really “Can I afford to back up?” It’s “Can I afford not to?”

Automate or Forget

The biggest enemy of backups isn’t cost — it’s forgetting. If backing up requires someone to plug in a drive, click a button, or remember to do something, it will eventually get skipped.

Automate everything you can. Set your backup software to run on a schedule. Cloud backups should be continuous or nightly. A local backup should run at least weekly, ideally daily.

Set it and forget it. Except for one thing: verify.

Test Your Backups. Seriously.

I mentioned this in the last post but it bears repeating: a backup you’ve never tested is just a guess.

Pick a file. Restore it from your backup. Confirm it works. Do this every month or so. It takes five minutes. It’s the difference between “I think we’re backed up” and “I know we’re backed up.”

The 3-2-1 Rule Is a Starting Point

This rule doesn’t cover everything — you also need to think about how often you back up (daily? hourly?), how long you keep old backups (30 days? 90 days?), and what you’re actually backing up (just files? system images? email?).

But the 3-2-1 rule is the foundation. Nail this first. Build on it later.

If you follow nothing else, do this:

1. Buy an external hard drive
2. Set up a cloud backup service
3. Automate both to run on a schedule
4. Test a restore once a month

That’s it. You’re ahead of 90% of small businesses already.

Want a step-by-step walkthrough of setting this up? I’ve put together a companion guide on Patreon that walks you through choosing a cloud provider, setting up automated backups, and creating a restore checklist. Check it out on Patreon.

With my small business scope in mind, I do worry that there are solid battlers out there, earning an honest dollar with little to no budget or time to spend on adequate backup solutions. I assume they’re running some sort of system like OneDrive, Google Drive or Dropbox thinking they’re backed up to the cloud, job done right? Nah, that’s a sync, not a backup.

That may sound elitist, but this is a critical distinction. It’s the difference between recovering from an IT disaster or losing everything. Let’s crack on to understand the difference and clear it up.

What People Think Backup Means

A backup should never be treated as chore. I think some SMB’s (small medium business) treat backups as a task that once done is completed. Data copied to an external hard drive, maybe some files saved in cloud storage. Tick!

Little care of thought is given to something that, in my humble opinion, is one of the most important things a business can do. In my day to day job, albeit a big multi country company, there is always someone (practically weekly) that asks if I can restore a file/folder because they accidentally overwrote/deleted it.

Side Quest (Rant)

I’m going to take a quick detour here for a rant. Feel free to skip this part but I think I need to dump this so I stay sane.

It really grinds my gears that people are so flippant with their corporate data. “Oh can you restore x, I accidentally deleted it”. What would happen if we didn’t have that backed up? Would you be more careful?

I grew up in the 80’s and 90’s where we had trampolines with exposed springs and no safety nets. You’d do a flip or some munter mate would double bounce you. You would often land, legs between the springs, grazes etc… if you were lucky. Sometimes you would bounce straight off altogether. This taught you to be careful unlike the children today that grow up with zipped up nets stopping them from learning a valuable life lesson.

Anyway the tramp rant is how I see people today. They are so used to having the net (backups) that they are reckless with their files. The assumption is that I can restore it for them. News flash, depending on budget, some things may not be backed up. Take some ownership and be careful with your files!

Anyway, enough of this rant even though it has been quite cathartic

What People Think Backup Means - Continued

What most people think is a backup is actually just file syncing — OneDrive, Google Drive, Dropbox. These tools are great for day‑to‑day use, but they’re not backup systems. That’s not what they were designed for.

Here’s why that matters: if you, your partner, or any staff you may have accidentally delete files or folders, that deletion is synced everywhere. If ransomware encrypts your files, the encrypted versions are replicated across all devices as well.

Most of these platforms do offer some mitigation by keeping a limited number of file versions that you can roll back to. But if you’re not regularly accessing all of those files and folders, there’s a real risk you won’t notice a problem until it’s too late.

Syncing keeps your files available. Backup keeps your files recoverable. Those are two very different jobs.

And files and folders aren’t the only things that need backing up. Locally installed software that’s critical to the business also needs to be considered. Is this software essential to how you operate? Can you recover if your hard drive gives up the ghost? Even if you have a copy, is it as simple as reinstalling and pointing the application back at the data?

So What Is a Real Backup?

To me, a real backup means in the event where you lose a file, delete a folder or you start your computer/laptop up and you have a blue screen of death, you know you are able to recover and get back up and running.

A real backup is a separate, independent copy of your data that can be restored to a specific point in time. The copy doesn’t change when your live data changes. No syncs, it’s just a break glass in case of emergency copy of your data for when you need it.

At a minimum following a 3-2-1 rule is a good starting point. This is a baseline to start with and you can build on it from there depending on how often your files are changing and how much work you want to make for yourself:

• 3 copies of your data (the original plus two backups)
• 2 different types of storage (say, a local device and the cloud)
• 1 copy stored offsite (physically separate from your office)

Remember, this isn’t overkill. It’s the minimum standard that actually protects you when things go sideways — whether that’s a hardware failure, a cyberattack, a fire, or plain old human error.

Where SMBs Commonly Get It Wrong

Blind trust, assumptions and wilful thinking is where most issues arise.

If you are lucky enough to have some IT guru that takes backups for you have you verified them? Do you know how often or what is being backed up? There is a common saying in Crypto Currency circles, “don’t trust, verify” which basically means don’t trust a “trust me bro” person, make sure it is what they say it is.

Some think they are small fish, too small to be a ransomware target. Well, given the current landscape with AI and script kiddies online. It’s not a case of if you will be targeted but a case of when. We are all busy and prone to mistakes especially when you’re grinding hard to make a buck and you mistake a malicious email for a legit one. Never assume you are too small to be a target. Some people just dangle a hook out there with malicious stuff for shits and giggles and you happen to be the fish that latches on.

Lets say you actually do have backups. Have you tested them? This comes back to the “don’t trust, verify”. A backup isn’t a backup until you can verify it will be capable of doing what you need it to do. If you have taken a full backup image of your computer have you restored this in a development location to confirm:

1. You actually know how to restore your computer in a disaster recovery situation
2. That your backups are actually working Verify!!!.

“We back up our files, so we’re fine.” Files are only part of the picture. What about your email? Your accounting software? What about your passwords that you save to your browser (which you shouldn’t but that is another topic later). A proper backup strategy covers your entire business environment, not just the documents folder.

Why This Matters More Than You Think

Data loss isn’t a hypothetical. Hard drives fail. Employees make mistakes. Ransomware is a real and growing threat to every business no matter the size. And when data disappears, the consequences are immediate: operations grind to a halt, invoices can’t go out and customer records vanish

The businesses that recover quickly from these events aren’t lucky — they’re prepared. They have real backups, they test them regularly, and they know exactly what’s protected and what isn’t.

What You Should Be Asking

You don’t need to become a backup expert. But you do need to ask the right questions — of yourself, or of whoever manages your IT:

• What exactly is being backed up? (Files, emails, databases?)
• How often are backups running?
• Where are the backups stored? Is there an offsite copy?
• When was the last time a backup was actually tested by restoring data from it?
• How long would it take to get back up and running after a total loss?

If you can’t answer these questions — or if the answers make you uncomfortable — that’s a sign it’s time to take a closer look.

The Bottom Line

“Backup” isn’t a product you buy or a box you tick. It’s a strategy. It’s knowing that when something goes wrong — and eventually, something will — you can get your business back to where it was, without losing days, weeks, or years of work.

If the only thing standing between your business and total data loss is a OneDrive sync and a prayer, it’s time to have a proper conversation about what backup really means.