Learn / Small business security
Backups and ransomware readiness for small businesses
The 3-2-1 rule, immutable and offline copies, and how to prove you can actually recover before you ever need to.
Why backups decide how a ransomware attack ends
Ransomware encrypts your files and demands payment for the key, and modern gangs usually steal a copy of your data first so they can threaten to publish it. You cannot prevent every infection, but you can decide in advance whether an attack is a bad week or the end of the business. The deciding factor is almost always whether a clean, recent backup exists that the attacker could not reach.
Attackers know this. Once inside a network they look for backup servers, network drives and cloud sync folders and try to delete or encrypt them before launching the main attack. A backup that is always connected and writable from a normal office PC is not a ransomware backup. For how the attacks work, see ransomware explained.
The 3-2-1 rule, updated
The classic rule is simple:
- 3 copies of important data (the original plus two backups),
- on 2 different types of storage,
- with 1 copy offsite.
Many practitioners now extend it to "3-2-1-1-0": one copy offline or immutable (it cannot be changed or deleted for a set period) and zero errors when you test a restore. Immutable storage is offered by many cloud backup services (often called object lock or retention lock), and an external drive that is unplugged after each backup achieves something similar cheaply.
What to back up
| Data | Where it often lives | Notes |
|---|---|---|
| Accounting and payroll | Cloud app or local file | Export regularly even if the vendor backs up |
| Microsoft 365, Google Workspace | Deleted items expire; a third-party backup covers mistakes and malicious deletion | |
| Shared files | File server, OneDrive, Google Drive, Dropbox | Sync is not backup: a deletion or encryption syncs too |
| Line-of-business databases | Local server or hosted | Ask the vendor exactly how to restore |
| Configurations | Router, firewall, website | Small files, painful to recreate from memory |
| Password manager vault | Cloud | Keep the recovery kit offline |
Testing: the step everyone skips
A backup you have never restored is a hope, not a plan. Put these on the calendar:
- Monthly: restore a random file or folder and open it.
- Quarterly: restore a full machine or a whole mailbox to a test location and time how long it takes.
- Yearly: run a tabletop exercise: "Every PC is encrypted on Monday morning. What do we do, in what order, and how long until we can invoice customers again?"
Write down the recovery time you measured. If it is three days and the business cannot survive three days offline, you have learned something important while there is still time to fix it.
Store the backup admin password and the recovery instructions somewhere that does not depend on your normal network, such as a sealed envelope in a safe or a separate password manager account.
Other ransomware readiness steps
- Patch internet-facing systems quickly. VPNs, firewalls and file-transfer tools are common entry points, as the MOVEit incident showed.
- MFA on remote access and email, so stolen passwords alone are not enough.
- Separate admin accounts, so one phished user cannot reach the backup server.
- Endpoint protection switched on and monitored on every computer.
- Know who to call: your IT provider, your cyber insurer (many require you to call their hotline first) and, in the US, the FBI through its IC3 reporting site.
Should you pay?
Law enforcement agencies generally advise against paying, because payment funds further attacks and does not guarantee you get working keys or that stolen data is deleted. Paying can also carry legal risk if the recipient is a sanctioned party. That decision belongs to the business owner with legal counsel and insurer advice. The best way to avoid facing it is a tested, offline backup.
This is general education, not legal or insurance advice. Talk to a qualified professional about your specific obligations.
