The 3-2-1 backup rule in practice: how to know your backups will actually restore
Almost every company we audit says “yes, we have backups”. Far fewer can tell us when they last restored a file from them. A backup you have never tested is a hope, not a plan. This article explains a proven rule and a simple routine that turns hope into certainty.
The 3-2-1 rule
- 3 copies of your data: the original and two backups.
- 2 different types of storage, for example a NAS in the office and cloud storage.
- 1 copy off-site, physically away from the office.
Modern versions add two more digits, 3-2-1-1-0: one copy that is offline or immutable, and zero errors in restore tests.
Why immutable copies matter now
Ransomware groups no longer only encrypt your files. They look for your backups first and delete or encrypt them, so you have no choice but to pay. An immutable backup cannot be changed or deleted for a set period, even with administrator credentials. Most cloud storage providers offer object lock for this, and many backup tools support it directly.
What to back up
- Servers and virtual machines: full images, so you can restore a whole system, not just files.
- File shares and NAS devices.
- Microsoft 365 or Google Workspace: mail, OneDrive, SharePoint, shared drives. The provider keeps the service running but does not protect you from deletion or ransomware in your account.
- Websites: files and database, ideally daily.
- Configuration: firewall, switches and Wi-Fi settings. Rebuilding a firewall from memory during an outage is painful.
Two numbers to agree on
RPO (Recovery Point Objective): how much data you can afford to lose. If you back up nightly, you may lose up to one day of work.
RTO (Recovery Time Objective): how long you can afford to be down. Restoring a 2 TB server from the cloud over an office connection can take days. If that is too long, keep a local copy as well.
A quarterly restore test in five steps
- Pick something real: one important folder, one mailbox and, every second quarter, a whole server.
- Restore it to a different location, never over the original.
- Check the result: open files, compare sizes, start the restored virtual machine and log in.
- Measure the time. Is it within your RTO?
- Write down the date, what was restored, how long it took and any problems.
The first test almost always finds something: a folder that was never included, an expired cloud credential or a backup job that silently failed months ago. That is the point of testing.
Monitor every job
Backup software sends reports, but daily emails are easy to ignore. Make sure failed or missing jobs create an alert that someone is responsible for. In our infrastructure plans, backup monitoring is included and restore tests are part of the Standard plan.
Not sure your backups would survive ransomware? Backups are one of the checks we run at onboarding after our free IT audit.