Ask most small business owners if they have a backup, and the answer is almost always yes. Ask what it actually is, and the answer is usually an external hard drive somebody plugs in occasionally, or a folder that syncs to the cloud. Neither of those is wrong to have — but neither one is a real backup strategy on its own, and the gap between "I have a backup" and "I have a backup that will actually save me" is where businesses get hurt.
The industry standard for closing that gap is called the 3-2-1 rule. It's not complicated, but it's specific for a reason — each part of it exists because of a real way backups fail.
What the rule actually says
3 copies of your data. Not one copy, not two — three. That includes the original, live copy you use every day, plus two more. One copy is never enough, because "one copy" just means you have exactly one thing standing between you and total loss.
2 different types of media. Your two backup copies shouldn't both live on the same kind of storage. A backup on an external hard drive plus a backup on a second external hard drive sitting right next to it isn't really diversified — if that model of drive has a defect, or the same event damages both, you lose both at once. Mixing media types (a local drive plus a cloud backup, for example) means a single point of failure can't take out everything.
1 copy offsite. At least one of your backups needs to be physically somewhere else. This is the part people skip most often, and it's the part that matters most. A backup sitting in the same building as your main systems doesn't protect you from a fire, a flood, a break-in, or any event that takes out the location itself. "Offsite" doesn't have to mean exotic — a reputable cloud backup service counts, as does a drive rotated to a different physical location.
Why RAID doesn't count as a backup
This trips up more people than anything else in the rule. RAID (redundant drive setups, common in NAS devices) protects you from a single drive failing — the system keeps running because the data exists on more than one disk. That's a real and useful feature. It is not a backup.
RAID does nothing to protect you from ransomware encrypting your files, an employee accidentally deleting the wrong folder, a power surge frying the whole device at once, or a fire. All of those wipe out every drive in the array simultaneously, because RAID protects against hardware failure, not against data loss events. If your entire backup plan is "we have a NAS with RAID," you have redundancy, not a backup.
Why an untested backup isn't a backup either
The other quiet failure mode: a backup that's been running for two years, that nobody has actually tried to restore from. Backups fail silently more often than people expect — a job that's been "completing successfully" while actually skipping corrupted files, a drive that's been degrading without anyone noticing, cloud storage that stopped syncing after a config change nobody caught.
A backup you haven't tested by actually restoring from it is a backup you're assuming works. The only way to know is to periodically pull a real file back from it and confirm it's intact and usable — not just confirm the backup job ran.
What this looks like in practice for a small business
- Live copy: your day-to-day working files — point-of-sale data, client records, whatever your business runs on.
- Second copy, different media: a local NAS or external drive, ideally imaged and verified rather than just "files copied over."
- Third copy, offsite: a cloud backup service, or a drive physically rotated to a second location on a regular schedule.
- Tested restore: on a schedule — quarterly is reasonable for most small businesses — actually restore a file and confirm it opens correctly. None of this requires exotic equipment or a dedicated IT department. It requires structure — knowing which of your "copies" are actually independent of each other, and confirming, occasionally, that the whole thing works before you're forced to find out during an actual emergency.