Backup and Disaster Recovery: A Practical 3-2-1 Plan for Small Businesses

Most small businesses don't lose data to sophisticated attacks—they lose it to a failed hard drive, a stolen laptop, an accidental delete, or ransomware that only needed one unpatched machine to get in. A backup plan that actually works matters more than one that looks impressive on paper.

What the 3-2-1 rule actually means

The 3-2-1 rule is the baseline most IT and security frameworks still recommend, and it holds up because it's simple:

• 3 copies of your data: the original plus two backups.
• 2 different media or systems, so a single point of failure—like one cloud provider outage or one failed drive—can't take out everything.
• 1 copy off-site, physically or logically separated from your main location, so fire, theft, or a site-wide incident doesn't destroy every copy at once.

For a small business, this usually looks like: production data in your primary system, an automated daily backup to cloud storage, and a separate immutable or offline copy that ransomware sitting on your network can't reach or encrypt.

Why "we have backups" often isn't true when it counts

The most common failure isn't missing backups—it's backups nobody has tested:

• Backup jobs silently failing for weeks because no one is alerted.
• Backups stored on the same network share the ransomware can also encrypt.
• No documented restore process, so recovery time is a guess during an actual incident.
• Backups covering servers but not the SaaS data (email, CRM, shared drives) the business actually runs on.

A backup you haven't restored from is a hypothesis, not a plan.

Building a plan that survives ransomware specifically

Ransomware changes the requirements slightly, because the attacker's goal is to destroy your recovery options along with your live data:

• Immutability: at least one backup copy that cannot be modified or deleted, even by an admin account, for a set retention window.
• Isolation: backup credentials and storage separated from day-to-day admin accounts, so a compromised laptop can't reach the backup system directly.
• Versioning: multiple restore points over time, since encryption is sometimes discovered days after it started.

A minimum-viable schedule for most small businesses

• Daily: automated incremental backups of active systems and shared files.
• Weekly: a full backup verification—confirm the job ran, check for errors, not just that a report says "success."
• Quarterly: an actual test restore of a real file or system to a separate location, timed so you know your realistic recovery time.
• Annually: a full disaster recovery run-through, including who is responsible for what during an incident.

What to do this week if you're not sure where you stand

• List every system that holds data you couldn't afford to lose—including SaaS tools, not just servers.
• Confirm each one has an automated backup, and check when it last actually succeeded.
• Pick one backup and try to restore a single file from it today. If that's hard, recovery during a real incident will be harder.

Backup and disaster recovery isn't about buying more tools—it's about knowing, with evidence, that you can get your business back running within a time frame you've actually tested.