The 3-2-1 backup rule is the gold standard for data protection. Here's what it means, how to implement it, and why Microsoft doesn't back up your Microsoft 365 data.
If you ask a business owner whether they have backups, the answer is almost always "yes." But when you dig into the details — what's being backed up, where, how often, and when it was last tested — the picture gets a lot less reassuring.
Backups are one of those things that feel like a checkbox until the day you actually need them. This article covers the 3-2-1 backup rule: what it is, why each piece matters, and the gaps most businesses have in their current setup.
What Is the 3-2-1 Backup Rule?
The 3-2-1 rule is a simple framework for data protection:
- 3 copies of your data (the original plus 2 backups)
- 2 different types of storage media
- 1 copy stored offsite (physically separate from your primary location)
It was originally coined by photographer Peter Krogh and has been adopted by NIST, CISA, and every serious data protection framework since. The logic is simple: it's designed to ensure there's no single point of failure in your backup strategy.
Let's walk through each component.
3 Copies of Your Data
Your "production" data — the files your business runs on right now — is copy one. You need at least two additional backup copies.
Why two? Because backups fail. Hard drives fail. Cloud services have outages. If you have only one backup and something goes wrong during a restore, you're out of options. Two backups give you a fallback.
This doesn't mean you need three separate backup jobs running constantly. A typical setup might look like:
- Copy 1: Production data on your server or workstations
- Copy 2: Local backup to a NAS device or external drive
- Copy 3: Cloud backup (Veeam, Acronis, Datto, Backblaze Business, etc.)
2 Different Media Types
Storing both backups on the same type of media — say, two external hard drives sitting next to each other — doesn't protect you from hardware failure, fire, flood, or theft. "Different media" means different storage mechanisms.
Practical examples:
- Local NAS (network-attached storage) + cloud backup
- Server snapshot + offsite tape (less common today but still used)
- On-premises backup appliance + cloud replication
The underlying point: don't put all your eggs in one basket, and don't put two baskets on the same shelf.
1 Copy Offsite
This is the rule most often neglected. An offsite copy ensures that a physical disaster — fire, flood, burst pipe, theft, or even a localized ransomware attack that wiped your on-premises systems — doesn't take out all your data at once.
"Offsite" can mean:
- Cloud backup — data is stored in a geographically separate data center (this is the most practical offsite solution for small businesses)
- Colocation — tapes or drives physically moved to another location (rarely used by small businesses today)
- Data center replication — for enterprises with high availability requirements
For most small businesses, a cloud backup service effectively handles the "1 offsite" requirement. The key is ensuring that offsite copy is automated, encrypted, and actually tested.
Cloud Backup as Offsite
Services like Datto, Veeam, Acronis Cyber Protect, Backblaze Business, and Axcient can serve as your offsite copy. They run automatically, store encrypted copies of your data in geographically redundant data centers, and give you a restore point going back days, weeks, or months.
When evaluating a cloud backup solution, ask:
- How frequently does it back up? (Hourly is better than nightly for most businesses)
- How far back can I restore from?
- How quickly can I restore (RTO — Recovery Time Objective)?
- How much data loss is acceptable (RPO — Recovery Point Objective)?
- Is the backup encrypted in transit and at rest?
The Microsoft 365 Backup Myth
This is one of the most dangerous misconceptions in small business IT:
"Microsoft backs up my Microsoft 365 data."
Microsoft does not back up your email, OneDrive files, Teams data, or SharePoint in the way you're thinking. Their infrastructure protects against data center failures, but it does not protect you from:
- An employee accidentally deleting a year's worth of emails
- A disgruntled employee mass-deleting files before they leave
- A ransomware attack that encrypts your cloud files (yes, this can happen through OneDrive sync)
- Restoring data beyond Microsoft's retention windows (typically 30–93 days for most plans)
Microsoft's own Service Agreement states: "We recommend that you regularly backup Your Content and Data that you store on the Services."
You need a third-party backup solution for Microsoft 365. Options include Veeam Backup for Microsoft 365, Acronis Cyber Protect Cloud, and Backupify. These typically cost $3–$6 per user per month — a small price for proper protection.
Testing Your Backups
Having backups is necessary but not sufficient. Untested backups are just hopes.
You should test backup restores:
- At least quarterly for critical data
- After any significant system change
- Immediately after setting up a new backup solution
A restore test means actually pulling data back from the backup and confirming it's complete, uncorrupted, and usable — not just verifying that the backup software says "success."
We've seen businesses discover their backup had been silently failing for months only when they tried to restore after a crisis. Don't be that business.
RTO vs. RPO: Know Your Numbers
Two key metrics define your backup strategy requirements:
Recovery Time Objective (RTO): How long can your business function without access to your data? An hour? A day? A week? This determines how fast your restore process needs to be.
Recovery Point Objective (RPO): How much data loss is acceptable? If your backups run nightly and a disaster strikes at 4 PM, you could lose an entire day of work. Is that acceptable for your business?
A dental practice might have an RPO of 4 hours (backups run every 4 hours during business hours) and an RTO of 2 hours (they can recover systems within 2 hours). An accountant during tax season might need tighter numbers.
Define your RTO and RPO, then make sure your backup solution actually meets them.
Need Help?
TechniWorx designs and manages backup solutions for businesses across the Chicago area — including Microsoft 365 backups that most IT providers overlook. If you're not sure whether your current backup strategy would survive a real incident, request a free backup assessment and let's find out.