In this guide · 8 sections
- 01What the 3-2-1 backup rule means
- 02The modern version: 3-2-1 plus an immutable copy
- 03Mapping 3-2-1 to a typical small office
- 04How often to back up: RPO and RTO in one minute
- 05Test restores: the step most offices skip
- 063-2-1 and Singapore's Cyber Essentials mark
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
The 3-2-1 backup rule means keeping 3 copies of important data (the original plus two backups), on 2 different types of storage, with 1 copy off-site. Today, add one copy that ransomware cannot change (offline or immutable) and test restores regularly.
What the 3-2-1 backup rule means
The US cybersecurity agency CISA calls it "a trusted guideline" in its small business backup guidance:
| Number | Rule | Protects against |
|---|---|---|
| 3 | Three copies of important files: the original plus two backups | One backup turning out to be broken or incomplete |
| 2 | Two different types of storage, for example a drive and the cloud | A single kind of failure (a bad disk batch, a cloud account lockout) |
| 1 | One copy off-site, away from your business location | Fire, flood, theft or a break-in at the office |
CISA adds three practical points on the same page: use backups that run automatically, protect them with physical security, encryption and offline copies, and test that you can restore both whole systems and single files, rolling back at least seven days if needed.
The modern version: 3-2-1 plus an immutable copy
Ransomware changed the rule. Attackers now look for backups first. CISA's StopRansomware guide tells organisations to maintain offline, encrypted backups of critical data and to test them regularly, because many ransomware strains try to find and delete or encrypt any backup they can reach.
- Offline: a copy that is physically disconnected, such as a drive that is unplugged and taken home or locked away.
- Immutable: a copy that cannot be changed or deleted for a set period, even by an admin account. Many cloud storage services and NAS snapshot features offer this.
- Separate credentials: the backup admin login is not the same as your everyday Microsoft 365 or Windows admin, and has its own MFA.
Some vendors call this 3-2-1-1-0: one copy offline or immutable, and zero errors when you test a restore. The name matters less than the idea.
Mapping 3-2-1 to a typical small office
Most Singapore SMEs have three kinds of data: cloud apps (email, files), laptops, and sometimes a server or NAS in the office.
| Data | Copy 1 (original) | Copy 2 | Copy 3 (off-site / immutable) |
|---|---|---|---|
| Microsoft 365 or Google Workspace mail and files | The live tenant | Built-in retention and recycle bins (short-term) | A third-party or Microsoft 365 Backup copy stored separately |
| Laptops | The laptop | Files synced to OneDrive or Google Drive | Cloud backup of those files with versioning beyond sync |
| Office NAS or file server | The NAS | Snapshots on the NAS | Encrypted, immutable copy in cloud storage or a second site |
| Accounting and other SaaS | The vendor's system | Regular exports (reports, CSV) | Exports stored with your other backups |
Built-in retention is short. Our guide on backing up Microsoft 365 and Google Workspace notes that Exchange Online keeps permanently deleted items for 14 days by default (30 at most) and a Google Workspace admin can restore a deleted user for only 20 days. For the office NAS side, see Synology NAS vs cloud backup.
How often to back up: RPO and RTO in one minute
The rule tells you how many copies to keep, not how often. Two numbers answer that.
- RPO (recovery point objective): how much work you could afford to lose. If losing a day of invoices is acceptable, nightly backups are enough; if not, back up more often.
- RTO (recovery time objective): how long you could be down. A cloud backup that takes two days to download may be too slow for your main file share.
Our guide to RTO and RPO explained walks through setting both for a small business.
Test restores: the step most offices skip
A backup job that says "successful" only proves something was copied. It does not prove you can get it back, quickly, by someone other than the person who set it up.
Restore one file every month
Pick a random file from last week and restore it to a test folder. Check it opens.
Restore a whole mailbox or folder every quarter
Time how long it takes. Compare with your RTO.
Restore from the off-site or immutable copy at least once a year
This is the copy you will need in a ransomware case, and the one least often tested.
Write down how you did it
A one-page restore note with logins (stored safely), steps and who to call. CISA stresses that a plan only helps if people know how to use it.
Fix what failed
Missing folders, expired logins and full storage are normal findings. Fix them while nothing is on fire.
3-2-1 and Singapore's Cyber Essentials mark
Backup is one of the five areas of CSA's Cyber Essentials mark, the national baseline for small organisations. A 3-2-1 setup with tested restores is a practical way to show you back up essential data regularly and keep it separate. Our Cyber Essentials mark checklist lists the related measures.
3-2-1 checklist for a small office
Do it yourself or get help?
A very small office can get close to 3-2-1 with a cloud backup service for Microsoft 365 or Google Workspace, plus an encrypted external drive rotated weekly and kept off-site. The discipline is the hard part: rotating the drive and testing restores.
If you want it set up properly once, our Backup & Ransomware Recovery service (S$290, paid upfront) sets up local and immutable off-site copies, Microsoft 365 or Google Workspace backup, alerts and a first documented restore test. For comparing providers, see choosing a backup service in Singapore. IT Sorted is a Singapore-based team of developers with over 10 years of experience.
Frequently asked questions
Keep three copies of your important data: the original and two backups. Store them on two different types of storage, such as a drive and the cloud. Keep one copy off-site, away from your office. Today it is also wise to make one copy offline or immutable so ransomware cannot delete it, and to test restores.
Not on their own. They protect against their own hardware failures and keep deleted items for a limited time, for example 14 days by default for permanently deleted Exchange Online items. They do not give you a separate copy that survives an account takeover, a late-noticed deletion or a deleted user. Add a separate backup.
Sync helps because files are no longer only on the laptop, but it is not a full backup. If files are deleted or encrypted on the laptop, sync copies that change to the cloud. Version history and recycle bins help for a while. A separate backup with longer retention, ideally immutable, completes the 3-2-1 rule.
An immutable backup is a copy that cannot be changed or deleted for a set period, even by someone with admin access. It protects against ransomware and against attackers who steal an admin password and try to wipe your backups. Many cloud storage services and NAS snapshot features offer this as an option.
A practical rhythm is a single-file restore every month, a larger restore such as a mailbox or folder every quarter, and a restore from the off-site or immutable copy at least once a year. Record each test with the date, what was restored and how long it took.