IT-Ops Field Notes

How to Build a 3-2-1 Backup Strategy for a Small Business

Published

Losing a NAS to ransomware, a drive failure, or a fire are three completely different failure modes — and a single backup, no matter how good, only protects against some of them. The 3-2-1 rule exists because it’s the smallest setup that survives all three at once.

Search intent

Someone searching this wants a concrete plan for combining local and offsite backup for their business’s files — not a definition of “what is 3-2-1,” but how to actually build one without overspending on redundant tools.

What 3-2-1 actually means

  • 3 copies of your data: the original (production data) plus at least two backups.
  • 2 different media/storage types: don’t put both backups on identical drives in the same enclosure — a firmware bug or a bad batch of drives can take out both at once.
  • 1 copy offsite: at least one backup lives somewhere physically separate from your office, so a fire, flood, theft, or on-site ransomware event that hits everything in the building doesn’t take out every copy.

Some modern variants add a fourth number — “3-2-1-1-0” (one copy offline/immutable, zero backup errors after verification) — worth knowing about if ransomware is a specific concern, since an attacker with network access can encrypt or delete backups that stay online and writable.

What this looks like in practice for a small business

Copy 1 — production data. Wherever your team actually works day to day: a NAS, a file server, or synced local drives.

Copy 2 — local backup, different media. A second NAS, an external drive array, or a dedicated backup appliance that isn’t the same device as production. If copy 1 is a NAS, copy 2 shouldn’t be “a second share on the same NAS” — that protects against accidental deletion but not against the NAS itself dying. See our NAS buying guide if you’re sizing a second device for this role.

Copy 3 — offsite backup. This is the one people skip because it’s the least convenient, and it’s also the one that saves the business when the office itself is the point of failure. Two realistic options:

  • Cloud object storage (Backblaze B2, Wasabi, AWS S3) paired with a backup tool like Restic — see our automated offsite backups with Restic or Borg guide for exact setup steps and current per-GB pricing (roughly $6/TB/month for B2 at the time that guide was written — reverify current pricing, since cloud storage pricing shifts).
  • A second physical location: a drive or small NAS that lives at an owner’s home, a second office, or a safe-deposit box, rotated on a schedule. Lower ongoing cost, higher manual effort, and it depends on someone actually doing the rotation — the classic failure mode of physical offsite backup is the drive that never left the building.

For most small businesses, cloud object storage wins on reliability because there’s no human step that can be skipped — the backup job runs on a timer whether or not anyone remembers to swap a drive.

A concrete example setup

  1. Production: files live on a NAS or file server in the office.
  2. Local backup: NAS’s built-in snapshot feature (Synology Hyper Backup, TrueNAS ZFS snapshots, etc.) to a second NAS or an attached drive array — catches accidental deletion and ransomware within the retention window, restores fast since it’s on the local network.
  3. Offsite backup: a nightly Restic job (or your NAS vendor’s cloud-backup app, e.g. Synology C2 or QNAP Hybrid Backup Sync) pushing to Backblaze B2 or a similar object-storage target — catches the case where the office itself is unavailable.

This is 3 copies (production, local backup, offsite backup), 2 media types (NAS snapshots + cloud object storage), 1 offsite (the cloud copy) — the rule satisfied without needing a fourth device or a tape library.

Immutable/offline backups (the “+1” that stops ransomware)

Ransomware that encrypts a NAS will happily encrypt anything the NAS can write to, including a backup target it has live network access to. Two ways to break that chain:

  • Object-lock / immutability on the cloud target — Backblaze B2 and most S3-compatible providers support write-once object locking for a configurable retention period, so even a compromised backup job’s credentials can’t delete or overwrite existing backups until the lock expires.
  • Air-gapped media — a drive that’s only connected during the backup window and disconnected/powered off otherwise (or genuinely offsite and not network-reachable) can’t be touched by malware that’s active on the network.

If ransomware is a real concern for your business (client data, no dedicated IT security staff), enabling object-lock on the cloud copy is the highest-value single change to this setup — it’s usually a checkbox, not a rebuild.

Retention and testing

  • Retention: keep enough history to recover from an issue you don’t notice immediately — daily backups for 1-2 weeks, weekly for a couple months, monthly for a year is a reasonable small-business default. Adjust for compliance requirements if any apply to your data.
  • Test restores: a backup that’s never been restored is unverified. Do a real test restore — not just a job-succeeded log line — on a schedule (quarterly is a reasonable minimum), and specifically test the offsite copy, since it’s the one you’ll need in the worst-case scenario and the one tested least often in practice.

What this costs

Costs scale with data volume, but the pattern for a small business (a few hundred GB to a few TB of business-critical files, not full system images of every workstation) typically breaks down as:

  • Local backup: a one-time hardware cost for a second NAS or drive array (see the NAS buying guide), no recurring fee beyond electricity.
  • Offsite backup: a recurring per-GB cloud storage fee — reverify current pricing before budgeting, since object-storage pricing changes; check the provider’s pricing page directly rather than relying on a number that may be months old by the time you read this.

The recurring cost is usually smaller than people expect relative to the cost of a full data-loss event, which is the actual comparison that matters.

Bottom line

3-2-1 isn’t a specific product — it’s a shape: one production copy, one local backup on different media, one copy that’s physically elsewhere. For a small business already running a NAS, the fastest path there is NAS snapshots for the local copy and a scheduled Restic/Borg (or vendor cloud-backup app) job to object storage for the offsite copy, ideally with object-lock enabled on the cloud side. Build it once, then actually test a restore — that second step is what separates a real backup strategy from a false sense of security.