The 3-2-1 backup rule, and what it means for client fleets in practice
The 3-2-1 rule: keep 3 copies of the data (production plus two backups), on 2 different types of storage, with 1 copy offsite. The modern extension is 3-2-1-1-0: 1 of those copies offline or immutable so ransomware cannot reach it, and 0 errors when you actually test a restore.
RAID, sync folders and snapshots on the same box are not backup copies. Anything that replicates a deletion or an encryption event within seconds fails the test that matters.
What counts as a copy
A copy is something that survives the failure of the others. That single sentence disqualifies most of what clients believe they have:
- RAID survives a disk, not a deletion, a ransomware run, a controller failure or a theft.
- OneDrive, Dropbox and sync tools replicate whatever happens to the files, including the encryption of all of them. Version history softens this but retention is limited and per-file recovery at scale is grim.
- Snapshots on the production filer die with the filer.
- Microsoft 365 and Google Workspace replicate for their own availability, not yours. Retention policies help; they are not a backup you control.
A shape that works for small business clients
| Copy | Where | Protects against |
|---|---|---|
| 1. Production | The machines and the file server | |
| 2. Local backup | NAS or backup server on site, different hardware | Disk failure, fat fingers, fast restores |
| 3. Offsite, immutable | Object storage with a retention lock, or rotated offline media | Fire, theft, ransomware, angry insiders |
The third copy earns its keep the day ransomware runs with domain admin rights. If the backup target is reachable as a writable share from the network it was supposed to protect, assume it is already gone. Object lock, an air gap, or credentials that live nowhere on the client network are the difference.
RPO and RTO, in client words
RPO is how much work the client can afford to lose: the gap between backups. RTO is how long they can afford to be down: the restore time. Agree both per system, in writing, before the incident. A payroll server and a marketing file share do not deserve the same schedule, and clients discover strong opinions about both numbers at the worst possible moment.
The 0 in 3-2-1-1-0
An untested backup is a hope, not a plan. The failure modes are mundane: a job that has been silently erroring for months, a backup of the wrong folder, credentials that expired, an image that boots to a blue screen. Test file-level restores monthly and a full restore of one critical system quarterly, and record the result where the client can see it. The test that finds the problem costs an hour; the incident that finds it costs the client.
Verification is a habit, not an event.
Moorfox gives every managed machine a security score covering disk encryption, AV, patch age and more, with the same philosophy: measured continuously and honest about anything it could not check.
Frequently asked questions
Is OneDrive or Dropbox a backup?
No. Sync tools replicate changes, including deletions and ransomware encryption, to every copy within seconds. Version history provides limited protection but retention is capped and restoring thousands of files by version is impractical. Keep an independent backup of synced data.
Does RAID count as one of the 3 copies?
No. RAID is availability, not backup: it protects against disk failure only. A deletion, corruption or ransomware event hits every disk in the array simultaneously.
How often should restores be tested?
File-level restores monthly, and a full restore of at least one critical system quarterly. Log the results. The point of the test is to find the silent failure before an incident does.