1R
1REALTOUR Team
·November 1, 2026·5 min read
Table of Contents
The 3-2-1 Backup Rule for Small Business
What the 3-2-1 Backup Rule Says
The 3-2-1 rule is a plain guideline for protecting important data. The US Cybersecurity and Infrastructure Security Agency (CISA) describes it this way:
3: Keep three copies of any important file, one primary and two backups.
2: Keep the files on two different media types to protect against different types of hazards.
1: Store one copy offsite, outside your home or business facility.
The idea is that no single event should be able to destroy every copy. A failed drive, a stolen laptop, a fire or a hacked account should each leave at least one good copy behind.
Why the Rule Matters for a Small Business
Small businesses rarely lose data in dramatic ways. It is usually something ordinary: a website update that breaks the database, a staff member deleting a shared folder, a hosting account that gets suspended, or a laptop that dies the week before a deadline.
Ransomware is the bigger threat. CISA's ransomware guidance warns that many ransomware variants look for accessible backups and delete or encrypt them so the victim has no choice but to pay. A backup that sits on the same network, with the same logins, can be lost in the same attack. That is why CISA recommends keeping offline, encrypted backups of critical data and testing them regularly.
How to Apply 3-2-1 in Practice
Copy One: Your Live Data
This is the working copy: your website, your shared drive, your accounting file, your CRM. It is the copy most likely to be damaged, because it is the one people and software touch every day.
Copy Two: A Local or Same-Provider Backup
A second copy kept close by makes quick restores easy. For a website, this is often a nightly snapshot on the hosting platform. For office files, it may be a backup drive or a second storage service. It is useful for small mistakes, such as restoring one page or one file.
Copy Three: An Offsite, Separate Backup
The third copy is the one that saves you in a real disaster. It should live with a different provider or in a different location, use different credentials, and be encrypted. If your hosting company, your office or your main admin login is compromised, this copy should still be untouched.
What a Small Business Should Back Up
Many owners think of backups as copies of office documents. In practice, the systems that would hurt most to rebuild are often online. Make a list that covers:
Website files and the website database. A WordPress site, for example, needs both to be restored.
Online store data, including orders, customers and product catalogs.
Email and shared drives in your cloud workspace. Cloud providers keep services running, but deleted or overwritten data may not be recoverable after their retention period ends.
CRM records, help desk tickets and signed documents.
Accounting files and exports from any software that does not keep its own history.
DNS settings, domain registrar details and the list of accounts that control them.
Configuration for custom applications, so a server can be rebuilt instead of recreated from memory.
For each item, note who owns it, how it is backed up today and where the copies live. Gaps usually show up quickly.
Common Gaps We See
Backups that live on the same server as the website, so a server failure takes both.
A single backup copy that gets overwritten every night, so a problem noticed a week later cannot be undone.
Website files backed up, but not the database, or the other way around.
Backups that use the same admin account as the live system.
Backups nobody has ever tried to restore.
Recovery Goals: RPO and RTO
Two terms help you decide how much protection you need. NIST defines the recovery point objective (RPO) as the point in time to which data must be recovered after an outage. In plain terms, it is how much recent work you can afford to lose. If you back up once a night, you could lose up to a day of orders or form submissions.
The recovery time objective (RTO) is how long a system can be down before it seriously hurts the business. An online store and a brochure site have very different answers. Write both numbers down for each important system, then pick a backup schedule and restore plan that meets them.
A Backup Is Only Real After a Restore Test
A backup job that reports success is not proof that you can recover. Files can be incomplete, encryption keys can be lost, and restore steps can be forgotten. CISA advises testing the availability and integrity of backups in a disaster recovery scenario on a regular basis.
A simple test plan for a small business looks like this:
Pick one system, such as the website.
Restore the most recent offsite backup to a separate test location.
Check that pages load, forms work and recent content is present.
Time the process and compare it to your RTO.
Write down each step so someone else can repeat it.
Repeat on a schedule and after major changes.
Do Not Forget Retention
Retention is how long old backups are kept. If you keep only yesterday's copy, malware or a bad edit that went unnoticed for two weeks is already in every backup you have. Keeping a mix of daily, weekly and monthly copies gives you more points in time to restore from.
How 1REALTOUR Helps
1REALTOUR runs encrypted, off-site backups with scheduled restore tests for the websites and applications we manage. We set retention, document recovery steps and confirm restores actually work instead of trusting a green checkmark. See our backup and disaster recovery service, or pair it with managed WordPress hosting and ongoing website maintenance.
FAQs
What is the 3-2-1 backup rule?
The 3-2-1 backup rule means keeping three copies of important data, on two different types of media, with one copy stored offsite. CISA recommends the 3-2-1 rule so that a single failure, theft or disaster cannot destroy every copy.
Does a hosting company's backup count as offsite?
How often should a small business test its backups?
Why does ransomware make backups more important?
More Insights
Black and white still life of white spheres passing through a narrow gate toward a dark phone-shaped slab.
What Is A2P 10DLC? Why Business Texts Get Blocked
Blog • Web Solution
Read Article
Black and white abstract of many thin lines converging into a single white disc at the center.
What Is a SIEM? Security Monitoring Explained
Web Technologies • Blog
Read Article
Black and white image of a pulse line drawn across a white wall, passing behind a blank square panel.
Uptime Monitoring vs Status Pages: What Each One Does
Hosting • Blog
Read Article
