How should a company back up its data? The 3-2-1 rule and the blind spots everyone misses

Data is the lifeblood of a company, yet many teams think of backup as little more than "we saved a copy somewhere". Only when disaster actually strikes — a drive dies, ransomware encrypts the whole machine, an employee deletes the wrong folder, the server room floods or burns — do they discover there is no copy that can actually be restored. Backup is not about whether you saved something; it is about whether you can get it back when things go wrong.

First: sync is not backup

This is the most common misconception. "Sync" services like Google Drive, OneDrive and Dropbox simply mirror the same file to the cloud in real time — if you delete it locally or ransomware encrypts it, the change syncs upward and destroys the cloud copy too. A real backup is an independent copy you can roll back to at a point in time. Sync does not give you that.

The industry-standard 3-2-1 rule

No need to overthink it — 3-2-1 covers most situations:

• 3 copies: keep at least three copies of important data (one in production, two as backups).
• 2 media: store them on two different kinds of storage (server disk + NAS, or local + cloud) so one class of device failing cannot take out both.
• 1 off-site: keep at least one copy in a different physical location or the cloud, so fire, theft or a site-wide incident cannot reach it.

The blind spots everyone misses

• Never testing a restore: backups run faithfully, but nobody has ever actually restored one. When it matters, the backup turns out corrupt — or nobody knows how to restore it. The value of a backup is in the restore, not the backup.
• Backups living on the same machine or in the same room as production: one failure takes out both.
• No version history: only the latest copy is kept. After ransomware encrypts your files, the backup gets overwritten with the encrypted version. Keep multiple points in time.
• Copying database files directly: copying a live database’s files often captures an inconsistent state that only fails at restore time. Use proper dumps or snapshots.
• Unencrypted, loosely-permissioned backups: a backup holds your most sensitive data in one place — a leak hands over everything at once. Encrypt off-site and cloud backups and lock down access.

How often should you back up?

There is no universal answer — it comes down to two questions: how much data can you afford to lose (an hour? a day?), and how quickly must you be running again after an incident. The first sets your backup frequency; the second sets how fast your restore path needs to be. A transaction-heavy system may need near-real-time backup; ordinary documents may be fine with once a day.

In short

Good backup is not about expensive hardware — it is multiple copies, in different places, that genuinely restore, verified on a schedule. Identify the data you truly cannot lose, apply 3-2-1, and rehearse a restore periodically, and you avoid most disasters. If you are unsure whether your current backups are enough, or want a reliable, self-verifying backup and recovery setup, we can help assess and plan it.