The 3-2-1 rule says you should keep three copies of your data, on two different types of storage, with one of them outside your office. Today it's also recommended that one copy be immutable or offline, so ransomware can't encrypt it, and that you test restores regularly. Back up your accounting and invoice XML files, your systems' databases, work files, your website and your cloud accounts.
- Three copies, two different media, one off-site.
- Add an immutable or offline copy to protect yourself from ransomware.
- Syncing isn't backing up: if you delete something in Drive, it's deleted everywhere.
- A backup that has never been restored is just a hope.
- Define how much data you can afford to lose and how long you can afford to be down.
- In Mexico, electronic accounting records must be kept for the periods set by the Federal Tax Code.
Why backups fail right when you need them
The stories repeat themselves. The accountant's computer dies and the last backup of CONTPAQi or Aspel (Mexico's most common accounting packages) is four months old. Ransomware encrypts the server and also the external drive that was plugged in. Someone deletes a shared folder in Google Drive and the deletion syncs to every computer. The website vendor disappears with the only copies.
In every case, the business "had backups." What it didn't have was a system: copies that are separate, automatic, protected and tested. That's what the 3-2-1 rule solves.
You don't need an IT department. A small business with five to fifty people can have a solid setup with common tools and a 30-minute monthly review.
The 3-2-1 rule, and its current 3-2-1-1-0 version
| Number | What it means | Small business example |
|---|---|---|
| 3 copies | The original plus two backups | The files on the computer, one local backup and one in the cloud |
| 2 different media | Not everything on the same type of device | External drive or NAS, plus cloud storage |
| 1 off-site | Safe from theft, fire or flood | The cloud, or a drive kept at another address |
| 1 immutable or offline | Nobody, not even a virus, can delete or encrypt it | Storage with object lock, or a drive that's unplugged after the backup runs |
| 0 errors | Restores tested with no failures | A monthly test recovering files and a database |
The extended version came about because of ransomware: attackers also hunt for and encrypt backups connected to the network. An immutable copy, which can't be modified for a defined period, or one that's physically disconnected, is the one that saves you.
What to back up in a business
- Accounting and invoicing: accounting system databases, the XML and PDF files of CFDI invoices issued and received (CFDI is Mexico's mandatory electronic invoice), tax returns and filing receipts. Mexico's Federal Tax Code generally requires you to keep accounting records for five years.
- Your systems' databases: point of sale, CRM, inventory, payroll, time clock.
- Work files: quotes, contracts, blueprints, designs, case files.
- Email: especially if it contains agreements with customers and suppliers.
- Website and online store: files and database, beyond whatever your hosting provider does.
- Cloud accounts: Google Workspace or Microsoft 365, critical spreadsheets such as an inventory in Google Sheets.
- Configurations: automation workflows, templates, access details documented in your password manager.
A good exercise is to ask yourself: if this computer or this account disappeared tomorrow, what couldn't I do on Monday? Invoice, collect payments, run payroll, fill orders. Whatever answers that question goes first on the list. If you issue invoices from an automated system like MonkeyFactura, also check where the XML files are stored and make sure you keep your own copy, not just the one held by the e-invoicing provider.
Syncing isn't backing up
This is the most common confusion. Google Drive, OneDrive and Dropbox sync: they keep the same version on all your devices. If you delete a file or ransomware encrypts it, the change syncs too.
They do have trash folders and version history that help, but with limits: Google Drive's trash deletes files after 30 days, and earlier versions aren't kept forever either. Under the shared responsibility model, Google and Microsoft guarantee that their service works; recovering what you or your team deleted by mistake is your responsibility.
For Google Workspace or Microsoft 365 accounts with important data, use a dedicated backup service that keeps independent copies with its own retention.
How often to back up: decide how much you can lose
Two questions define your setup, and it's worth answering them for each system:
- How much data can you afford to lose? If you back up every night and the drive fails at 6 p.m., you lose the day's work. For a point of sale that may be unacceptable; for a folder of designs, tolerable. In IT this is called the RPO (recovery point objective).
- How long can you afford to be down? Restoring a full server from the cloud can take hours. If your business can't stop, you need a fast local backup in addition to the remote one. This is called the RTO (recovery time objective).
| Data | Suggested frequency |
|---|---|
| Point of sale, orders, collections | Continuous or hourly |
| Accounting and invoicing | Daily |
| Website and online store | Daily; before every update |
| Work files | Daily, with versioning |
| Full computers | Weekly |
A practical setup for a small business
Here's an example for a professional firm or retailer in Torreón with 10 to 20 computers:
- Local copy: a NAS in the office receives nightly backups of the computers and the accounting system, with 30 days of versions.
- Cloud copy: the NAS replicates, encrypted, to external storage with object lock, which prevents the copies from being deleted or modified for a set period.
- Office cloud: Google Workspace or Microsoft 365 with an independent backup service.
- Website: an automatic daily backup outside the hosting account, in a separate account.
- Alerts: if a backup fails, two people get an email or WhatsApp notification.
For a smaller business, with one to five computers, a cloud backup service per computer is enough, plus an external drive that's plugged in only once a week and kept at the owner's home, and an independent backup of the email and documents account. What matters isn't the size of the investment, but that the copies are separate and reviewed.
For the systems we build, we apply the same principle: Docker on dedicated servers with encrypted backups sent to a different provider. That's how we set up the billing and collections system for the municipal water utility in Durango, installed on its own server with an encrypted off-site backup.
Test the restore, not just the backup
A backup that has never been restored is a hope, not a backup. Schedule a monthly test:
- Recover a random file from two weeks ago and open it.
- Restore the accounting system's database on a test computer and check that the numbers match.
- Every three to six months, simulate losing an entire computer and time how long it takes to get back to work.
- Write down the date, result and time. That log tells you whether your plan works.
Tests often turn up useful surprises: a backup that excluded a new folder, a database copied while open that ends up corrupted, an encryption password nobody remembered. It's much better to find out on an ordinary Tuesday than on the day of an emergency.
It's an important task but never an urgent one, exactly the kind of item that gets forgotten; schedule it as a recurring event. The Eisenhower matrix explains why those are the tasks that protect a business the most.
The website case
Many businesses assume their hosting provider backs up the site. Some do, but on the same server, with short retention, or they charge to restore. And if the site is hacked, the hosting backup may be infected too. That's why you should keep several weeks of history: if the infection started ten days ago, you need a copy from before that date, not last night's. Before every update to plugins, themes or WordPress itself, make an extra manual backup.
When we rescued the WordPress site for Hidrantes y Rociadores del Norte, one of the first steps was setting up encrypted daily backups stored off the server. In the guide to fixing a hacked WordPress site we explain the full process, and in the one on shared hosting vs. VPS, what to expect from each type of server.
Checklist
- I have a list of which data is critical and where it lives.
- Every system has at least three copies on two media, one off-site.
- At least one copy is immutable or offline.
- Backups are automatic and alert me if they fail.
- Backups are encrypted and the key is in the password manager, not on the same server.
- I test restores every month and log the results.
- More than one person knows how to restore.
Backups are the last line of defense; the first ones are in the guide to small business cybersecurity basics. If you'd like us to review your setup or build it for you, reach out through our software development service.
