Imagine that on Monday morning, your company's employees can no longer access important files. Financial documents, customer information, contracts, and data from ongoing projects are inaccessible.
The reason could be server damage, employee error, cyberattack, or a simple technical glitch.
How long will your company be able to continue operating?
The answer to this question is not determined solely by whether you have backups of your data. What matters more is where those backups are stored, how secure they are, and how quickly you can restore the information.
It exists to solve this problem. 3-2-1 Backup Strategy — International data backup practices that even small and medium-sized businesses can implement.
What is the 3-2-1 Backup Strategy?
3-2-1 Backup is a data protection method that recommends businesses store important information in multiple independent copies, using different storage media and physical locations.
Its main principle is simple:
- 3 – Three copies of the data: One original and at least two backup copies.
- 2 – Two different storage options: For example, a company's work server and a separate NAS device or Cloud Storage.
- 1 – One copy outside the company office: At another physical location or in a cloud infrastructure.
How does this work in a real environment?
Let's imagine a company operating in Tbilisi that has its own file server.
| Copy | Location | Purpose |
|---|---|---|
| Original | Company's main server | Daily activities |
| First Backup | Standalone NAS located in the office | Fast local recovery |
| Second Backup | External Cloud Storage | Protection against local accidents and disasters |
If the main server is damaged, the company will restore information from the NAS device.
If there is a fire, flood, or theft in the office and both devices are damaged, an external Cloud Backup creates an additional opportunity to restore information.
Important: Three copies does not mean storing data in three different folders on the same server. The backups should be independent enough that a single failure or security incident would not destroy all of them.
Main types of data backups
There are several methods for storing backups. Each has different advantages, costs, and usage scenarios.
1. On-site Backup – storing data on company premises
On-site Backup refers to storing backup copies of data in the same office or building where the main IT infrastructure is located.
For this, companies can use:
- External HDD or SSD devices;
- NAS (Network Attached Storage);
- Dedicated Backup Server;
- Local data storage (Storage System).
Advantages
The main advantage of local backup is the speed of recovery. Large volumes of information can be restored using the company's internal network, without downloading from the Internet.
In addition, the company has better control over the physical location of its devices and can automate the backup process.
Risks
If the backup device is constantly connected to the same network and the same administrative accounts are used for it, a cyber attack can damage both the main server and the backup copies.
On-site backup alone also cannot provide sufficient protection against fire, flooding, and other physical incidents.
Who is it suitable for?
For companies that need daily work with large volumes of files and fast recovery — for example, architectural firms, design studios, accounting organizations, and various office businesses.
2. Off-site Backup – Backup to another physical location
Off-site backup means storing data in a location physically separate from the company's main infrastructure.
This could be a second office, a data center, a server located in another city, or a specialized backup storage facility.
For example, a company located in Tbilisi can have its core infrastructure in its own office, while storing backup data in another independent data center.
Advantages
Off-site Backup reduces the risk that a single physical incident will simultaneously destroy both the working system and its backup.
Geographic separation is especially important for companies whose operations depend on the constant availability of data.
Risks
Recovery time depends on the connection to the remote infrastructure, the amount of data, and the recovery method.
It is also necessary to have independent access control, encryption, and constant monitoring of remote storage.
Off-site Backup can be either a physical device or Cloud Storage. The main requirement is that it be located in a location independent of the main infrastructure.
3. Cloud Backup – storing data in a cloud infrastructure
Cloud Backup involves the automatic backup of data to a remote infrastructure via the Internet.
For this, it is possible to use specialized services such as Amazon S3, Backblaze B2, Azure Backup, or other relevant Cloud Storage and Backup platforms.
In the case of Cloud Backup, the business is not obligated to purchase and manage all physical storage itself.
Advantages
- Automate backups;
- Increase storage capacity as needed;
- Geographically separated storage;
- Maintaining different historical versions of data;
- Restore to another device or infrastructure.
Risks and limitations
When using Cloud Backup, the speed of your internet connection is important. For example, a full restore of several terabytes of data may take much longer than restoring the same information from a local NAS.
The monthly cost of storage, possible data download fees, retention periods, and platform access policies should be considered.
Cloud Storage does not by itself mean secure backup. This requires appropriate backup policies, historical versions, and restore capabilities.
4. Offline and Immutable Backup – Additional Protection Against Cyberattacks
In modern cyberattacks, attackers often try not only to encrypt work data, but also to delete its backup copies.
Two important approaches are used to mitigate this risk.
Offline Backup
The backup copy is stored on a device that is physically or logically isolated from the work network after the copy is complete.
For example, an encrypted external drive that is safely removed and stored in a separate location after the backup is complete.
Immutable Backup
This is a backup copy, the modification or deletion of which is restricted by special technological mechanisms for a predetermined period of time.
For example, properly configured Object Lock technology can protect data from deletion and overwriting for a specified retention period.
Immutable Backup is particularly useful in recovering from Ransomware attacks, when a company needs to restore old, unaltered data.
However, neither Offline nor Immutable Backup replaces other security controls: encryption, access management, system updates, and attack detection mechanisms.
What is the difference between Cloud Storage, Sync, and Backup?
One common misconception is that using Google Drive, Microsoft OneDrive, or another cloud platform automatically provides a perfect backup strategy.
In fact, File synchronization and standalone backup are not the same thing.
For example, if an employee accidentally deletes a synced file, the deletion operation could spread to other devices.
Some cloud platforms have historical file versions and deleted data recovery features, but they are subject to specific storage policies and limitations.
A standalone backup system can be configured to preserve old copies and allow data recovery even in the event of a work environment failure.
It should also be noted that:
- RAID is not a backup. Disk consolidation can increase resilience to hardware failures, but it cannot protect against accidental deletion or all types of cyberattacks.
- A snapshot is not always an independent backup. If the Snapshot depends on the same storage, the loss of the underlying infrastructure may make it impossible to restore.
- Replication does not replace historical backup. Continuous replication can also transfer corrupted or deleted data to another system.
Therefore, synchronization, replication, and snapshots are useful, but a full-fledged strategy also requires independent, time-retained backups.
Full, Incremental and Differential Backup – How are copies created?
In addition to where backups are stored, how they are created is also important.
Full Backup – Full backup copy
During a Full Backup, a complete copy of the protected data is created.
This method is simple in terms of recovery, but requires a large volume and copying time.
Incremental Backup – Backup of changes
After the first full backup, the system only stores data that has changed since the last backup.
This reduces the time and data volume required for daily backups.
Recovery, depending on the technology, may require a full copy and a chain of additional changes.
Differential Backup – Changes made since the last full backup
Differential Backup stores data that has changed since the last Full Backup.
It often requires more storage than Incremental Backup, but recovery can be easier because the last full and last differential copy are usually required.
Which method is better?
For many businesses, a practical model is periodic Full Backup and frequent Incremental Backup. However, the frequency and technology should be determined by the volume of data, the number of changes, and recovery requirements.
Which business data should be protected?
A backup strategy should include not only the company's shared folder, but also all information whose loss would disrupt operations.
For example:
- Financial and accounting documents;
- Contracts and legal files;
- Customer and partner data;
- CRM and ERP systems databases;
- Employee work files and projects;
- Websites, e-commerce systems and their databases;
- Important electronic correspondence and cloud workspaces;
- Server and network device configurations.
Special attention should be paid to databases.
Simply copying a database file does not always ensure that it can be restored correctly. It is necessary to use a backup method compatible with the database, consider transactional integrity, and practice recovery testing.
What does the 3-2-1 Backup strategy look like for a Georgian company?
Imagine a company with 20 employees that works with a CRM system, accounting software, and a shared file server every day.
The company can use the following model:
First layer – working infrastructure
Employee files and business applications are located on the company's main server or in cloud systems.
Second layer – Local Backup
Backups of the work server and important data are automatically stored on a separate NAS device.
If necessary, a specific file, folder, or system can be quickly restored.
Third Layer – External Cloud Backup
An additional backup copy of the data is periodically sent to an independent Cloud storage.
This copy uses a separate access policy, encryption, and, where possible, Immutable mode.
Fourth layer – recovery verification
The IT responsible person periodically checks whether files, databases, and if necessary, the entire server can be restored from backups.
The goal of this model is not simply to store data, but to create some real recovery capabilities for the business.
How often should backups be done?
There is no one universal frequency for all companies.
The backup interval depends on how much information loss is acceptable and how quickly the workflow needs to be restored.
Two indicators are used to make this decision.
RPO – Recovery Point Objective
RPO determines the time period during which a business can tolerate the loss of data created.
For example, if the RPO is 2 hours, the backup system should provide recovery points such that the potential data loss in the event of an incident does not exceed this requirement.
RTO – Recovery Time Objective
RTO determines how long it takes for a system to recover after a failure.
For example, if the RTO for an online store is 4 hours, the recovery infrastructure and procedures should be planned so that operations can resume within this timeframe.
Examples of backup frequency
| System | Initial frequency example |
|---|---|
| Common office documents | Daily |
| Accounting system | Daily or more often |
| CRM and ordering system | Every 1–4 hours or more often |
| Website and content | Daily and before significant changes |
| Critical transactional database | Frequent Backup or Continuous Change Protection |
This table is a planning example and not a mandatory standard for all businesses. The final frequency should be selected based on the RPO/RTO goals and the technical capabilities of the specific system.
How long should we keep backups?
A backup strategy should have a Retention Policy – a rule that defines the retention period for historical copies.
For example, a small business might use the following initial model:
- Daily restore points – for the last 14–30 days;
- Weekly copies – for the last 4–8 weeks;
- Monthly copies – for the last 3–12 months.
Such a retention policy allows the company to restore not only yesterday's data, but also an older state if the problem is detected late.
The timeframe should be consistent with business needs, storage costs, and applicable legal requirements. It is also important to consider the rules for timely data deletion, as not all information should be stored indefinitely.
Why isn't just creating a backup enough?
Imagine a company where backups are created automatically every day.
The IT administrator sees successful backup messages and thinks the data is protected.
A few months later, the server crashes, but upon recovery, it turns out that the required database is incomplete, the recovery chain is broken, or the critical system configuration was not saved at all.
That's why Successfully completing a backup and successfully restoring data are different outcomes.
A reliable backup strategy requires:
- Automatic monitoring – detection of failed backups and notification of the responsible person.
- Encryption – protecting data during storage and transmission.
- Independent access control – limited administrative rights and MFA on backup storage.
- Maintaining historical versions – to recover from accidental deletion or corruption.
- Isolated or Immutable copy – additional protection against attackers.
- Restore Testing – Periodic testing of actual file and system restores.
- Documented recovery process – responsible persons, instructions, required access, and recovery sequence.
It is important that recovery testing is conducted in a secure, isolated environment and does not damage the company's operating systems.
It is also essential to keep encryption keys and administrative access required for recovery secure.
3-2-1-1-0 – An Advanced Model for a Modern Backup Strategy
Modern cybersecurity practice also uses an expanded version of the classic 3-2-1 rule. 3-2-1-1-0.
| Number | Meaning |
|---|---|
| 3 | At least three copies of the data |
| 2 | Two different storage options |
| 1 | At least one off-site copy |
| 1 | At least one Offline, Air-gapped or Immutable copy |
| 0 | Zero error detected during recovery check |
This model is especially important for companies that depend on servers, e-commerce, financial systems, and customer data.
However, "0 errors" is a test goal and not a guarantee that future restores will complete without errors under all circumstances.
The main idea of the model is: a company should not only store data, but also regularly prove that it can be restored if necessary.
How can Georgian businesses start implementing the 3-2-1 Backup strategy?
Small and medium-sized businesses don't need to purchase complex, expensive infrastructure all at once.
In the first stage, the following practical steps can be taken.
Step 1 : Identify important data
Identify which files and systems your company relies on for its daily operations. Find out where each is stored and who has access to it.
Step 2: Check existing backup processes
Determine which systems are backed up, how often, where they are stored, and when a recovery test was last performed.
Step 3: Selecting local and external storage
For critical systems, prepare an independent local backup and at least one external copy.
Step 4: Set up security and automation
Enable automatic backups, error reporting, encryption, MFA, and appropriate access restrictions. For high-risk data, use an isolated or immutable copy.
Step 5: Recovery Practice Test
In a secure test environment, restore a few important files and one critical system. Check how long the process took and whether the result meets your RPO/RTO goals.
Step 6: Regular control
Backup should not be a one-time project. Periodically review data volume, recovery capabilities, storage costs, and security of new systems.
Frequently Asked Question (FAQ)
What is the 3-2-1 Backup Rule?
3-2-1 Backup is a data backup strategy that requires a company to have at least three copies stored on two different media, with at least one copy located in a physical location separate from the main infrastructure.
Is it enough to just store data in the Cloud?
Not always. Cloud storage can be an important part of a backup strategy, but it is necessary to evaluate historical versions, access control, independent copies, and recovery capabilities. File synchronization alone does not provide complete protection.
What is the difference between On-site and Off-site Backup?
On-site backup is stored on the company's premises and usually provides fast local recovery. Off-site backup is located in another physical location and reduces the risk of simultaneous data loss in the event of a local incident.
What is Immutable Backup?
An Immutable Backup is a backup copy that is protected from deletion or modification within a specified retention period by appropriate technological restrictions. It reduces the risk of data destruction due to accidental or intentional actions.
How often should backup restoration be checked?
The frequency depends on the criticality of the system and the company's risks. For small businesses, quarterly hands-on testing may be a good starting point, but critical systems require more frequent or automated testing. Additional testing is also necessary after significant infrastructure changes.
Can Backup Protect a Company from Ransomware Attacks?
Backup cannot stop a cyberattack or eliminate the possibility of information theft. However, properly secured, isolated, and verified backups significantly improve the ability to recover a company's data. Other cybersecurity measures are also needed.
Conclusion – Is your business prepared for data loss?
Data security is not just about using antivirus, firewall, or cloud services.
The company must have clear answers to three questions:
Where are our data backups stored?
What happens if the basic infrastructure is completely damaged?
How soon will we be able to resume work?
The 3-2-1 Backup Strategy is a good starting framework for answering these questions, and adding Offline, Immutable, and Verified Backups further enhances data protection and recovery capabilities.
The main thing is that the company does not perceive backup solely as a technical function.
Backup is part of business continuity, and its true value is seen at the moment of data recovery.
How secure is your company's data?
If you are not sure how well your backup system is organized, start by assessing your existing IT infrastructure.
Tech service Helps you assess your existing infrastructure and risks to determine the right data protection and recovery approach for your business.
