Cloud backup for a small business works when it follows the 3-2-1 rule: keep three copies of any important file, on two different types of storage, with one copy off-site. A cloud backup service usually supplies the off-site copy, but it is not the whole plan. This guide explains the rule and where it comes from, what to back up (including Microsoft 365 and Google Workspace data), how to test a restore, and finishes with a checklist.
What the 3-2-1 rule says
The clearest official statement of the rule is in Data Backup Options, a paper produced for US-CERT and now hosted by the US Cybersecurity and Infrastructure Security Agency. It sets the rule out in three lines:
- 3: keep 3 copies of any important file, 1 primary and 2 backups.
- 2: keep the files on 2 different media types to protect against different types of hazards.
- 1: store 1 copy offsite, for example outside your home or business facility.
Each number guards against a different failure. Two backups mean one bad backup is not the end. Two media types mean one kind of fault does not take everything. The off-site copy covers fire, flood and theft at the premises.
Where the rule comes from
The paper, by Paul Ruggiero and Matthew A. Heckathorn, carries a 2012 Carnegie Mellon University copyright and was produced for US-CERT, the United States Computer Emergency Readiness Team. Its footnote for the rule points to a book written for photographers: Peter Krogh's The DAM Book: Digital Asset Management for Photographers. The logic that protects a photo library that cannot be recreated suits a business whose records cannot be recreated either.
How cloud backup fits the rule
For a small office, a workable 3-2-1 arrangement looks like this:
- The working copy, on your computers, server or cloud service.
- A local backup, on a network storage device or external drive in the office.
- A cloud backup, held with a provider in a different location.
The cloud copy is automatic and off-site. Its weaknesses are that a large restore depends on your internet connection, and that it sits behind an account that has to be protected.
One distinction matters. File syncing is not backup. A sync service keeps the same files on several devices, which means a deletion or a file scrambled by ransomware is copied everywhere as well. A backup keeps separate, dated versions you can go back to.
What to back up
Start by listing where your important information lives.
| What | Where it usually lives | How to cover it |
|---|---|---|
| Shared files and documents | File server, network storage or cloud drive | Automatic local backup plus cloud backup with version history |
| Email, calendars and contacts | Microsoft 365 or Google Workspace | Check what the service retains, and add a separate backup if that is not enough |
| Accounting and payroll data | Cloud accounting package or a desktop file | Regular exports for cloud packages, and include desktop files in the backup |
| Line-of-business databases | Server or hosted application | Scheduled database backups, tested by restoring to a separate system |
| Website and online store | Web host | Confirm the host's backups and keep your own copy of files and database |
| Settings and configurations | Routers, firewalls and system admin consoles | Export configurations after every change and store them with the backups |
Microsoft 365 and Google Workspace data
It is easy to assume that because email and files are in the cloud, the provider backs them up for you. The providers' own documents describe a shared responsibility.
Microsoft's shared responsibility guidance names Microsoft 365 as an example of software as a service, and states: "For all cloud deployment types, you own your data and identities." Its responsibility table lists customer data as the customer's responsibility in every service model.
Google's shared responsibilities and shared fate guidance lists Google Workspace among its software-as-a-service applications and says of such applications that you remain responsible for your access controls and the data you choose to store in them.
In practice the provider keeps the service running and the infrastructure secure. Whether a deleted mailbox, an overwritten file or a departed employee's documents can be recovered depends on the retention and recovery features in your plan and how they are configured. Find out what yours does, and decide whether you also need an independent backup of that data.
ASD makes the same point for Australian businesses. Its cloud shared responsibility guidance for small and medium businesses says a backup process might be part of the cloud service, might be offered as an optional extra, or might be something you are required to implement yourself. It suggests questions to put to any provider, including:
- Does the provider back up your data, or do you need to?
- Do backups include all of your important data?
- Can you restore earlier versions of your data, or only the latest version?
- Are backups protected from being accessed, changed or deleted without your approval?
- Have you tested restoring data from a backup?
ASD also notes that the risk of your data being stolen, changed or lost stays with you as the customer, and cannot be outsourced to a cloud service provider.
Protecting the backups themselves
Assume that someone who breaks into your systems will try to remove the backups too. A few controls make that much harder:
- Protect the backup account with multi-factor authentication (a second proof of identity at sign-in), and do not use the same login for everyday work.
- Keep at least one copy that everyday accounts cannot change or delete. Some services call this an immutable or locked backup. A drive that is disconnected after each backup does a similar job.
- Encrypt backups, and store the recovery keys or passphrases somewhere you can reach if your main systems are down.
Testing restores
A backup that has never been restored is an assumption. Testing shows that the files are complete, that the people responsible know the steps, and how long recovery really takes.
- Restore a single file on a regular schedule. This is quick and catches most configuration problems.
- Restore a whole system, such as a mailbox, a shared folder or a database, to a separate location, and check that it opens and is current.
- Time it. Compare how long the restore took with how long the business could manage without that system.
- Write it down. Keep the restore steps where they can be found without the systems you are trying to restore.
Two questions set the schedule. How much work could you afford to redo? That decides how often backups run. How long could you operate without the system? That decides how fast the restore needs to be.
A 3-2-1 backup checklist
- We have listed every place important information is stored, including cloud services.
- Each item has three copies: the working copy and two backups.
- The copies sit on two different types of storage.
- One copy is off-site.
- Backups run automatically and someone checks the reports.
- We know what our Microsoft 365 or Google Workspace plan retains and have decided whether to add an independent backup.
- Backup accounts use multi-factor authentication and are separate from everyday logins.
- One copy cannot be changed or deleted by everyday accounts.
- We have restored a single file and a whole system, and recorded how long each took.
- A named person is responsible, and the restore steps are written down.
Where Comingwave fits
Comingwave is an Australian technology company that provides technology and business solutions to small and medium enterprises. Our cloud migration and hosting service sets up cloud storage and backup, our managed IT support monitors backups and runs test restores, and our cyber security service covers the access controls that protect them. If you are not sure your backups would hold up, ask us for a review.
Key takeaways
- The 3-2-1 rule means three copies, on two types of storage, with one off-site.
- Cloud backup supplies the off-site copy, and syncing files is not the same as backing them up.
- Microsoft and Google both say customers remain responsible for their own data in cloud services.
- Protect backups with multi-factor authentication and keep one copy that cannot be altered.
- A backup only counts once you have restored from it.
Frequently asked questions
Is cloud storage the same as cloud backup?
No. Cloud storage and file syncing keep your current files available on several devices, so a deletion or a damaged file is copied everywhere. Cloud backup keeps separate, dated copies that you can restore from after a mistake or an attack.
Does Microsoft 365 or Google Workspace back up my data for me?
Both providers describe a shared responsibility in which the customer remains responsible for its data. What can be recovered depends on the retention and recovery features in your plan, so check those and decide whether an independent backup is needed.
How often should a small business back up?
As often as it takes to keep losses tolerable. Ask how much work you could afford to redo if the latest changes were lost, and set the backup frequency to match.
Do two cloud services count as two types of storage?
The rule asks for two different media types so that a single kind of failure cannot affect every copy. Two separate providers improve on one, but a local copy on different hardware plus a cloud copy is closer to what the rule intends.
How do I know my backups will work when I need them?
Restore from them. Test a single file regularly and a whole system periodically, check the restored data opens and is current, and record how long it took. ASD lists testing a restore among the questions to ask about any cloud service.