The 3-2-1 Backup Rule for UK SMEs: Simple, Robust, and Testable

Most data loss in small businesses isn’t “Hollywood hacking”. It’s accidental deletion, device failure, a bad update, or ransomware that encrypts everything it can see. The 3-2-1 rule is a simple framework that dramatically improves recoverability without requiring enterprise complexity.

What “3-2-1” means

• 3 copies of important data (1 primary + 2 backups)
• 2 different media (e.g., local NAS + cloud/object storage)
• 1 offsite copy (physically or logically separate)

What you should back up (SME checklist)

• Business email (mailboxes, shared mailboxes, retention)
• Website and databases (files + DB dumps + configuration)
• Company files (SharePoint/OneDrive/NAS drives)
• Line-of-business apps (accounting data, CRM exports)
• Device configs (firewalls, routers, password vaults, MFA recovery)

RPO/RTO: the business view

Two numbers matter:

• RPO (Recovery Point Objective): how much data you can afford to lose (e.g., “last 4 hours”).
• RTO (Recovery Time Objective): how long you can afford to be down (e.g., “same day”).

These dictate backup frequency and restore design. A weekly USB drive rarely meets a real-world RPO/RTO once you do the maths.

Ransomware-safe backups

• Immutable storage (object lock / write-once policies) where possible.
• Offline / air-gapped copy for critical datasets.
• Least-privilege backup accounts (backups should not have admin everywhere).
• Monitoring for abnormal changes (mass deletes, encryption patterns).

Retention and versioning

A good policy gives you multiple restore points. A simple, effective pattern for SMEs is:

• Daily backups retained for 14–30 days
• Weekly backups retained for 8–12 weeks
• Monthly backups retained for 6–12 months

Testing restores

Test restores should be routine, not an annual panic:

• Quarterly restore test for a representative dataset
• Documented restore runbook (who does what, in what order)
• Time the restore to validate your RTO