The 3-2-1 rule means 3 copies of your data, on 2 different media, with 1 copy off-site. For an SMB, a backup plan costs $10-60/month at the basic level, $60-300/month at the standard level and $300-1,500/month managed 24/7. Restoring without backups can cost more than years of backup.

"We do backups" is the sentence we hear most from companies that have never had to restore anything. And that's exactly the problem: a backup that has never been restored isn't a guarantee, it's a hope. The 3-2-1 rule exists precisely to turn that hope into a plan that survives a dead disk, a fire or a ransomware attack.

In this article I explain what the 3-2-1 rule means in practice, how much it costs to set it up for a small or mid-sized company, which figures you need to calculate (RPO and RTO), and the mistakes that turn an expensive backup into a useless file on the day you actually need it.

What the 3-2-1 backup rule is

The rule goes like this: keep 3 copies of your data, on 2 different media, with at least 1 copy off-site (and, if possible, offline). Each number solves a different risk, and removing any of them leaves a hole.

The first copy isn't a backup

If your data only exists on the computer of the person who works with it, you don't have a copy: you have a single version of the original. Copy 1 is the backup of the file or database you use every day.

Two different media

Copy 2 lives on another medium: an external drive or NAS in the office, plus a cloud service. Two separate media protect against typical hardware failure, which usually takes down the original and its replica when they sit in the same place.

One offline or off-site copy

Copy 3 is the one that saves you from the serious scenarios: theft, fire, a massive accidental deletion, or ransomware that encrypts everything it sees on the network. If that copy is disconnected or in another location, the attacker can't encrypt it along with the rest.

In practice, most companies build this rule with a local drive or NAS, a cloud service, and a rotation of drives that leaves the office once a week. If you're considering moving infrastructure to the cloud, our cloud migration guide explains where to start.

External hard drive connected to a laptop Two different media: local drive and cloud, with one copy that leaves the office.

How much a business backup costs

Price depends on volume, how often your data changes and how often you restore. As a reference for an SMB:

Three price levels

  • Basic: $10-60/month. A single machine or server, daily cloud backup, 30-day retention.
  • Standard: $60-300/month. Several servers, backups every few hours, 90-day retention and restore tests.
  • Managed 24/7: $300-1,500/month. Business continuity, RPO in hours, duplication across two regions and a tested recovery plan.

Always compare the price with what it costs not to have the copy: two days of downtime can cost more than two years of managed backup. And if your sector handles customer data, the backup is also part of your regulatory compliance.

RPO and RTO: the two numbers you need to know

The RPO (recovery point objective) is how much data you can afford to lose: if you copy every 24 hours, your RPO is 24 hours of work. The RTO (recovery time objective) is how long you can be without the system running: hours or days depending on how the recovery is set up.

How to calculate your RPO

Look at what your company produces in a working day. If you invoice and process orders for 8 hours, losing a full day hurts much more than backing up every 4 hours. Backup frequency is decided by the operation, not by the price of the service.

RTO depends on something else: on whether the restore has been tested. Recovering a server from scratch can take hours if nobody has ever done it, and minutes if the procedure is documented and timed.

How to implement the 3-2-1 rule step by step

  1. Inventory your data: which systems are critical, how many GB there are and who uses them.
  2. Define RPO and RTO per system: not everything needs the same frequency.
  3. Set up automated copy 1 over the original (database, files, email).
  4. Add copy 2 on a different medium and copy 3 off-site or disconnected.
  5. Test the restore every quarter and time the process.

That last step is the one almost everybody skips, and it's the only one that proves the backup works. A team that rehearses the recovery arrives at the incident with the plan in hand; the one that doesn't improvises under pressure.

A team reviewing data on a laptop Business continuity is rehearsed: test the restore every quarter.

Common backup mistakes

  • Automatic backups nobody reviews: nobody knows whether they completed last night.
  • Retention that's too short: the mistake is spotted on day 40 and the copy has already expired.
  • Everything in the same rack, or in the same cloud account as the original.
  • Encrypted backups without the key stored separately: original and key are lost together.
  • Restores never tested, for "lack of time".

Any of these mistakes turns a backup budget into a waste. And if you want to see how a company degrades without a plan, in how to protect yourself from ransomware we analyze the most expensive scenario of all: everything encrypted and nowhere to restore from.

Conclusion: a backup only exists once you've restored it

The 3-2-1 rule isn't technical obsession: it's the cheapest way to make sure your business keeps running the day something fails. Three copies, two media and one off-site cost less than a single day of downtime.

At TakeYourDesign we build and test backups for companies, with cloud services plans, continuous monitoring and cybersecurity support. If you don't know how long it would take you to recover, tell us and we'll answer within 24 hours where you stand and what's missing.

Frequently asked questions

What does the 3-2-1 backup rule mean?

3 copies of your data, on 2 different media, with 1 copy off-site or offline. It's the minimum standard to survive ransomware or a dead disk.

How much does a backup cost for a business?

$10-60/month basic, $60-300/month standard and $300-1,500/month managed 24/7. See cloud services.

How often should I back up?

It depends on your RPO: daily at a minimum, every few hours if your data changes constantly. We'll help you calculate it in a free consultation.

What are RPO and RTO?

RPO is how much data you can afford to lose; RTO is how long you can be without the system. Together they define your recovery plan.

Do cloud backups protect against ransomware?

Yes, if the copy is separate from the original with enough retention. Extend protection with cybersecurity.

Do you test restores?

Yes, on our plans the restore is tested and timed every quarter. Ask for a backup plan.