Backup: the 3-2-1 rule explained simply (and how to test yours)

By Ricardo Da Silva, RSCOM · 10 October 2026

A failing disk, a stolen computer, ransomware or a simple mistake: sooner or later, every company loses data. The difference is between those who restore in an hour and those who lose months of work. The 3-2-1 rule is the reference method, and it is simple.

3 copies of your data

The original data, plus two backups. A single backup is not enough: the day you need it, it may be incomplete, old or damaged itself.

2 different media

For example a NAS (Synology, QNAP) on your premises and cloud storage. If one type of media fails or is hit, the other remains intact.

1 copy off your premises

Fire, water damage, burglary: if all copies are in the same place, they disappear together. One copy must be elsewhere, ideally in a data centre in Switzerland, which also makes it easier to comply with the data protection act (nFADP).

The essential extra today: an immutable copy

Ransomware also looks for and encrypts the backups it finds on the network. So we add an immutable copy (which cannot be changed or deleted for a given period) or an offline one. This is the “3-2-1-1-0” rule: the final “0” means zero errors at verification.

Tutorial: check that your backup really works

1. Look at the date of the last successful backup. If it is more than 24 hours old for your working data, there is a problem.
2. Check what is backed up: the server and computers, but also Microsoft 365 (e-mail, OneDrive, SharePoint), business software databases and accounting.
3. Do a restore test: pick a file from a week ago and restore it to a separate folder. Open it. If it opens correctly, your backup works for that file.
4. Once or twice a year: test the full restore of a computer or server, and measure how long it takes. That time is what will count on the day of a disaster.
5. Enable e-mail alerts on failure: a backup that fails silently is the most frequent scenario.

How long should backups be kept?

Keep several versions: for example the last 30 days, then one version per month for a year. Ransomware or a mistake can go unnoticed for several days; with a single version, you would be backing up… files that are already damaged. For accounting records, remember the 10-year retention obligation (art. 958f of the Swiss Code of Obligations).

To go further, a backup is part of a business continuity and disaster recovery plan (BCP / DRP) (page in French): knowing not only how to recover the data, but also how quickly the company can work again.

Read also

• Two-factor authentication is no longer enough: 5 blind spots to know
• Slow Wi-Fi at the office: the real causes (and is Wi-Fi 7 worth it?)
• Personal computers and external providers: how to protect company data

← All articles