Module 6 · 6.1

English

Nederlands English Deutsch

The 3-2-1 rule and what to back up

Module 6: Backups · Reading time: 10 minutes

Learning objective: After this lesson, you can determine what you need to back up (including your cloud services and email), explain the difference between synchronisation and a backup, and set up a simple 3-2-1 scheme for your own business.
Key concepts: backup, synchronisation, 3-2-1, version, retention period, cloud is not automatically a backup, shared responsibility

Why a backup is your last safety net

All the other measures in this course reduce the chance of something going wrong. A backup does something different: it makes sure you can carry on when something goes wrong. A laptop stolen from a car, a colleague who accidentally deletes a folder of quotes, an update that breaks your online shop, ransomware that encrypts everything: in all these cases, the question is no longer "how do we prevent this?" but "how quickly are we back up and running?".

A backup is a copy of your data that exists separately from the original and that lets you restore an earlier state. Those last few words matter. A copy that changes along with the original the instant it changes doesn't help you if the original is broken or encrypted.

The NCSC puts it plainly in its guidance on what to do during a ransomware attack: if there's no way to undo the encryption, backups are the only way to get your files back.

Synchronisation is not a backup

Many business owners think they have a backup because their files are "in the cloud". Usually what they mean is synchronisation: a folder on your laptop that's automatically kept identical to a folder in a cloud service, and often also to your phone and a colleague's laptop.

Synchronisation is useful, but it does exactly what it promises: keeping everything identical. Including the mistakes.

What happens	With synchronisation only	With a backup
You accidentally delete a folder	Disappears on all devices and in the cloud	Still in yesterday's backup
Ransomware encrypts your laptop	The encrypted files are neatly placed everywhere	The backup contains the unencrypted version
A colleague overwrites a quote	The old text is gone everywhere	You restore last week's version
The laptop is stolen	The cloud copy is still there (sync does help here)	The backup is there too

Many synchronisation services do have a recycle bin and versions: a deleted file can be recovered for a while, and the service keeps older states of a changed file. That's a genuine safety net and often the fastest way to recover something. But it's limited. The recycle bin is emptied after a fixed period, versions are thinned out, and anyone who takes over your account can also empty that recycle bin. Think of it as first aid, not as your only backup.

The 3-2-1 rule

A simple rule of thumb that the NCSC also recommends is the 3-2-1 rule:

3 copies of your data: the original plus two backups;
on 2 different types of storage (for example, your hosting provider's server and an external drive, or your laptop and a separate backup service);
of which 1 is in a different location, away from your office or in a different data centre.

The idea behind it: a single event should never be able to affect all copies at once. A fire in your office affects the laptop and the external drive next to it, but not the copy in a different location. An outage at one cloud service affects that service, but not the drive in your drawer. Ransomware affects everything that's connected, but not what's disconnected (more on that in lesson 6.2).

An example for Bakkerij Example:

Original: the admin records and recipes in cloud storage, the website and email at the hosting provider.
Copy 1: the automatic backups the hosting provider makes every night, on separate storage servers.
Copy 2: once a week, a backup of the most important folders and a download of the website backup onto an external drive, which is then disconnected and taken home.

What belongs on your list?

Most backup problems aren't caused by the backup failing, but by something never having been included in the first place. So start by making a list of everything your business runs on. Think of:

Files: documents, quotes, photos, designs, on laptops, a network drive (NAS) and in cloud storage.
Email: all mailboxes, including shared ones such as info@example.com and factuur@example.com. Note: anyone who retrieves mail using POP3 often only has that mail on that one computer.
Website and online shop: files and database. A website without its matching database is usually worth nothing.
Cloud services: the accounting package, the till system, the planning tool, the CRM. Can you export data from there, and how often do you do that?
Configuration: DNS records for your domain, router settings, password manager (with recovery details kept somewhere safe, see module 2).
Phones: photos of receipts, contacts, chat history if it matters for business.

For each item, write down: where it's kept, who backs it up, how often, where that backup is stored and how long it's kept. An empty cell in that table is a gap.

Shared responsibility with cloud services

"It's hosted with Microsoft (or Google, or my hosting provider), so it's safe." That's only half true. Large providers work on a shared responsibility model: the provider takes care of the servers, the data centre and the service's operation; you remain responsible for your own data, accounts and settings.

Microsoft states explicitly in its own documentation that, for every type of cloud service, even ready-made software such as Microsoft 365, the customer remains responsible for their data, their accounts and access to them. What the services themselves retain is limited and time bound. Two examples from the official documentation:

Exchange Online (the email in Microsoft 365) keeps permanently deleted mail for 14 days by default, which an administrator can extend to a maximum of 30 days. After that, it's gone.
Google Drive permanently deletes files that have been in the recycle bin for more than 30 days. After the recycle bin is emptied, an administrator can still recover files for 25 days; after that, according to Google, they can no longer be restored.

Those are decent safety nets for a mistake made last week. But if you only discover after two months that a departing employee emptied a folder, they won't help. For every service you use, check what the provider itself says about retention and restoring, and ask your provider if it's not clear. If you use the service for important data, arrange your own backup or a regular export.

In practice: what it looks like

At the example provider WebOké, several types of backup exist side by side, and they work differently:

WebOké Backups automatically creates a complete backup of a hosting package every night: files, databases, mailboxes and settings. These backups are stored encrypted on separate storage servers in a different data centre, and you can restore from the backups of the past 30 days yourself.
You can also create a backup yourself in DirectAdmin. That ends up in your own package, counts towards your storage, and so sits in the same place as the original. A copy like that only becomes a genuine extra copy once you download it and store it elsewhere.
In Nextcloud, the recycle bin and versions are the safety net for everyday work: deleted files and versions are kept for up to 31 days (sooner if the space is needed). The servers' system backups are there for emergencies and aren't accessible to customers. The manual itself recommends keeping your own copy of irreplaceable files too.
Two limitations mentioned in the knowledge base: an email that arrives and is deleted again on the same day isn't included in any overnight backup, and mail that's only kept on your computer via POP3 isn't included either.

Other providers may handle this similarly or very differently: different retention periods, backups only as a paid extra, or only an emergency backup you can't access yourself. Ask your provider and write the answer in your list.

Summary

A backup is a separate copy that lets you restore an earlier state; synchronisation also carries mistakes and encryption through to everywhere.
Recycle bins and versions in cloud services are useful, but time bound and not a replacement for a backup.
3-2-1: three copies, two types of storage, one in a different location.
Start by making a list of everything your business runs on, including email, databases, cloud services and configuration.
With cloud services, you remain responsible for your data; check what your provider retains and for how long.

Quiz

Exercise

Exercise D6.1: Your backup list and 3-2-1 scheme. Make a table of everything your business runs on: files, mailboxes, website and database, cloud services, configuration and phones. For each row, fill in where it's kept, who backs it up, how often, where the backup is stored and how long it's kept. Look up, for at least two cloud services, what the provider itself says about retention and restoring. Mark every row that doesn't meet the 3-2-1 standard and write down what you'll do about it.

Exercise D6.1: Your backup list and 3-2-1 scheme

Here's how to do it: (1) Make a table (on paper, in a spreadsheet or in the course's input field) with the columns: item, where it's located, who makes a backup, how often, where the backup is stored, how long it's kept, meets 3-2-1 (yes/no). (2) Fill in at least these rows: files on laptops, shared or cloud storage, every mailbox (including shared addresses such as info@), website or webshop (files and database), accounting package or other cloud service, DNS records of your domain, password vault (only where the vault is stored and where the recovery details are kept, not the contents). (3) For at least two cloud services, look up in the provider's official documentation what they keep themselves (trash, versions, backup) and for how long. Write down the period and the source (URL). (4) Check whether there are mailboxes retrieved via POP3, and note which computer that mail is then stored on. (5) Mark every row without a backup or that doesn't meet 3-2-1, and write one concrete measure with a date for each row.

All mailboxes are in the list, including shared ones.
Website and database appear as two separate lines in the list.
For at least two cloud services, the retention period according to the provider is stated, with a source.
Every line has an answer to "where is the backup stored".
There's at least one copy outside the office or in a different data centre.
For every red line there's a measure with a date.

Which item would you not have put on your list if you hadn't read this lesson?

Where are you now using synchronisation while you thought it was a backup?

What would you lose if you couldn't use your most important cloud service tomorrow?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing