The 3-2-1 approach, plus one
| Rule | What it means | Why |
|---|---|---|
| 3 copies | Your live data plus two backups | One failed copy is not the end |
| 2 kinds of storage | For example a local appliance and the cloud | Different failures hit different storage |
| 1 copy off site | Somewhere a fire or flood at your office cannot reach | Disasters are local |
| Plus 1 copy ransomware cannot touch | Offline or immutable | Attackers go after backups first |
Why backups are a security issue
Ransomware groups try to find and destroy backups before they encrypt anything, so recovery is part of security, not just IT housekeeping. CISA’s ransomware guidance recommends offline, encrypted backups of critical data, tested regularly. The FBI’s 2025 Internet Crime Report counted 3,611 ransomware complaints, and its reported losses leave out downtime, equipment and recovery costs, which can be far larger.
Put it in a plan
- List the systems you cannot work without and how long you can be without each.
- Match backup and recovery services to those times.
- Write down who does what during an outage, including how to reach your provider.
- Test a restore, then test it again on a schedule.
- Keep the internet side covered too, with backup internet so cloud recovery is not stuck behind a dead line.
Most businesses get backup as part of managed IT. Health care practices should also read our HIPAA cybersecurity guide.