Every business we audit has backups. Perhaps one in five has restores — verified recently, timed, and documented. The difference is invisible right up until the worst day of the company's year, which is exactly the wrong moment to discover it.
What 3-2-1 actually demands
Three copies of the data (production plus two backups). Two different media — so one bad firmware update or one encryption event cannot touch everything. One copy off-site — because fire, theft and floods do not respect server rooms. The rule is thirty years old and still correct; what has changed is that "off-site" can now mean an immutable cloud bucket instead of tapes in a car boot.
Ransomware changed the third copy
Modern ransomware hunts backups first: mapped drives, NAS shares, even cloud buckets with stored credentials. The off-site copy must be unreachable with the credentials that live on your network — immutability windows, separate authentication, or true air gap. If your backup software can delete the off-site copy, so can an attacker who owns your backup server.
The restore test is the product
A backup that has never been restored is a hypothesis. Schedule restores — a file, a folder, a whole VM — and time them. The numbers become your honest recovery capability, and they usually surprise people: the "we back up nightly" business discovers a full server restore takes fourteen hours over the link they have. Better to learn that on a Tuesday drill than during an outage.
When simpler is fine
A five-person office with everything in Microsoft 365 may need only a proper M365 backup and an occasional export — not a NAS estate. Match the architecture to what the business would actually lose. Backup platforms and storage for the fuller builds are on PrinterBullet; the architecture itself is described on our 3-2-1 capability page.
Talk this through with an engineer
Free, technical, and specific to your site — that's the consultation.
Book a Consultation