Data backup rules are simple: keep three copies of your important files, on two kinds of storage, with one copy in a different place. You also need to run backups often and check that you can restore them. A backup you have never tested is a hope, not a plan.
This guide is for small firms with no IT team. It uses public advice from the UK National Cyber Security Centre (NCSC) and the Cyber Security Agency of Singapore (CSA). You can set most of it up in an afternoon.
Why a backup is more than a spare copy
Files get lost in many ways. A laptop is stolen. A hard drive fails. Someone deletes a folder by mistake. Ransomware, a type of malware that locks your files, can also scramble them.
The NCSC wrote in 2019 that it had seen ransomware encrypt the original data and also the connected USB and network drives that held the backups. Some cloud storage that stayed connected was hit as well. So a backup that sits plugged in all day can be lost with everything else.
The NCSC also gives a rule of thumb for what to save. Back up anything you would miss if you could no longer reach it. For a small business, that usually means invoices, customer records, contracts, accounting files, staff records and product files.
Sources: NCSC, Offline backups in an online world (13 August 2019); NCSC, Backing up your data (first published 17 December 2018).
The 3-2-1 rule in plain words
The NCSC calls 3-2-1 the most common way to build resilient backups. It means at least 3 copies of your data, on 2 devices, and 1 copy offsite. Your live files count as one copy.
Here is how a small shop might do it:
- Copy 1: the working files on your office computer.
- Copy 2: an external hard drive that you back up to each night or each week.
- Copy 3: a cloud storage account in another location.
If the office floods, the cloud copy survives. If the cloud account has a problem, the hard drive survives. The NCSC says the rule scales effectively and protects critical data from a localised incident. A fire or a theft in your office is one example.
Source: NCSC, Offline backups in an online world (13 August 2019).
Keep one backup disconnected
The NCSC points out that 3-2-1 does not require any copy to be offline. That gap matters. If every copy is always connected, one malware infection can reach all of them.
The fix is to keep at least one backup offline at any given time. With a USB or external drive, unplug it when the backup finishes. The NCSC advises disconnecting removable media when it is not in use, because malware can spread to attached media on its own.
With cloud storage, you cannot unplug anything. Instead, protect the account with a strong password and 2-step verification, keep the number of devices that can write to it small, and use any setting that lets devices add new backups but not change old ones.
Sources: NCSC, Offline backups in an online world (13 August 2019); NCSC, Backing up your data (first published 17 December 2018).
How often to back up
There is no one correct number. The right gap is how much work you can afford to redo. If you can lose a day of work, back up daily. If an hour of orders is too much to lose, back up more often or use a tool that saves changes as you go.
The NCSC says the more often you back up, the less data you lose when you must recover. It also notes that most backup tools can run on a schedule, so you do not have to remember. If you use removable drives, set a calendar reminder.
The CSA gives the same message in its August 2024 advisory on data resilience. It tells individuals and organisations to perform regular backups, and asks firms to state how often they back up in their disaster recovery plans. Write your own schedule down in one short document and tell your staff where it is.
Sources: NCSC, Offline backups in an online world (13 August 2019); CSA, How Individuals and Organisations Can Ensure Data Resilience, advisory AD-2024-015 (5 August 2024).
How to test a restore without an IT team
Testing is the step most firms skip. Both agencies ask for it. The CSA advises regular backup tests to confirm there are no errors. The NCSC says backups should be regularly tested to check they work as expected.
You can do a basic test in about 20 minutes:
- Pick five files from different folders, including one recent file.
- Restore them from your backup to a new, empty folder. Do not overwrite the originals.
- Open each file. Check that it loads and that the latest changes are there.
- Note how long it took and what went wrong, if anything.
- Repeat on a set date, such as the first Monday of each month.
Once or twice a year, try a bigger test. Pretend a laptop has died and restore a full set of work files to a different computer. This shows whether you hold the passwords, keys and software you need.
The NCSC adds a quick tip for single mistakes. Turn on the recycle bin and file history features on your devices, because restoring one deleted file is faster than restoring a whole backup.
Sources: CSA, advisory AD-2024-015 (5 August 2024); NCSC, Offline backups in an online world (13 August 2019); NCSC, Backing up your data (first published 17 December 2018).
A short checklist to start this week
- List the data you could not work without.
- Set up three copies on two kinds of storage, with one offsite.
- Keep one copy disconnected when it is not being updated.
- Turn on automatic backups, and add 2-step verification to your cloud account.
- Test a restore and put the next test date in the calendar.
The CSA also notes that relying on a single backup may not be enough for important data. It recommends at least two separate backup options on different media. That fits neatly with the 3-2-1 idea.
Source: CSA, advisory AD-2024-015 (5 August 2024).
Sources
- National Cyber Security Centre (UK), Offline backups in an online world, 13 August 2019: ncsc.gov.uk/blog-post/offline-backups-in-an-online-world
- National Cyber Security Centre (UK), Backing up your data, first published 17 December 2018: ncsc.gov.uk/collection/top-tips-for-staying-secure-online/always-back-up-your-most-important-data
- Cyber Security Agency of Singapore, How Individuals and Organisations Can Ensure Data Resilience, AD-2024-015, 5 August 2024: csa.gov.sg/alerts-advisories/Advisories/2024/ad-2024-015