Backups for a Small Business: The 3-2-1 Rule in 20 Minutes a Week

A small business is backed up when it holds three copies of everything it needs to trade, on two kinds of storage, with one copy offsite and offline, and when somebody has restored a file from each copy in the last month. That is the 3-2-1 rule the National Cyber Security Centre recommends, it costs about £10 a month plus a £90 drive, and the routine fits in 20 minutes a week. This guide shows what to copy, where to keep it and how to test it.

Most owners think they are covered because the laptop syncs to the cloud. The government's Cyber Security Breaches Survey, published in April 2026, found that 43% of UK businesses identified a breach or attack in the previous year, 46% among small firms, and that 74% back up to a cloud service. Yet when the Tuckers Solicitors ransomware attack encrypted 972,191 files in 2020, the firm's backups were encrypted with them, and the Information Commissioner fined it £98,000. Small business backups fail in two ways: the copy sits on the same network as the thing it is copying, or nobody has ever tried to restore it.

Below: what 3-2-1 means and who coined it, the list of what a small business actually needs to copy, the three copies and what each one costs in October 2026, the retention windows your cloud tools already give you, the restore test that most firms skip, and the admin an AI agent can run so the weekly check happens whether or not you remember.

How we judged

1. Official guidance first. The rules come from the NCSC's small organisations guide, published 9 April 2026, and its "Offline backups in an online world" advice, updated in July 2026.
2. Government statistics. Breach and backup figures are from the Department for Science, Innovation and Technology's Cyber Security Breaches Survey 2025/26.
3. Real cases. The ICO's penalty notices, not vendor horror stories.
4. Prices read on 24 October 2026 from the providers' own pages, in pounds where the provider quotes pounds.
5. Nothing a one-person firm cannot do. Every step works with a laptop, one external drive and a consumer cloud account.

What the 3-2-1 rule means

Three copies of your data, on two different types of storage, with one copy offsite. The photographer Peter Krogh coined the phrase while writing the first edition of The DAM Book in the mid-2000s, and the NCSC states it the same way: at least three copies, on two devices, one of them offsite. Veeam's "3-2-1-1-0" variant adds one copy offline or immutable and zero errors after a verified restore. For a small business the practical version is:

Sync is not backup. If a file is encrypted or deleted on the laptop, the sync folder faithfully copies the damage. The cloud's version history gives you a window to undo it, but that window is short and it closes.

What a small business actually needs to copy

Make the list before choosing the tools. For most firms it is shorter than they fear:

• Accounts and tax. Invoices, receipts, bank exports and the bookkeeping file. HMRC expects records to be kept for at least five years after the 31 January filing deadline, so a lost year is a tax problem as well as an admin one.
• Customer records. The CRM export, the booking list, the mailing list, signed contracts and quotes.
• Email. A mailbox is a business record. Google Workspace and Microsoft 365 keep it on their servers, but a closed or compromised account takes it with it; export it twice a year.
• The website and the shop. The database, the product images, the theme and the domain login. Most hosts keep their own backups, but read how long for.
• Photos and designs. The logo files, the before-and-after shots, the brochure artwork.
• Passwords and keys. The password manager's encrypted export, printed recovery codes and the two-factor backup codes, kept with the local drive, not on the laptop.

Anything you would need to rebuild the business in a week is on the list. Anything you could download again from a supplier is not.

Copy one: the working copy, and what sync really gives you

The cloud sync folder is already your first copy and it is better than nothing. Every major service keeps deleted files and old versions for a while, and knowing the window matters because it is the difference between an undo and a loss:

The pattern: a month is the default almost everywhere. If ransomware encrypts your files on a Friday and you notice six weeks later, the sync service has already forgotten the good versions. That is what copies two and three are for.

Copy two: the external drive you unplug

Buy a 2 TB external hard drive, which price-comparison sites listed at roughly £85 to £100 in October 2026, and let the operating system do the work. On a Mac, Time Machine is free: plug the drive in and it keeps hourly backups for 24 hours, daily for a month and weekly until the disk fills, and Apple recommends a drive at least twice the size of the Mac's storage. On Windows, File History and the built-in backup tools do the same job.

Then unplug it. The NCSC's small organisations guide says the backup drive should not stay connected when it is not in use, because ransomware encrypts every drive it can see, and the Tuckers case is what that looks like: the firm had no multi-factor authentication, a critical patch was applied five months late, and the attackers reached the backups through the same network as everything else.

Keep the drive somewhere other than next to the laptop. A desk drawer protects against a laptop failure; the glovebox or your home protects against a break-in at the unit.

Copy three: offsite and automatic

The third copy should happen without you. Two routes work for a small firm:

• A backup service. Backblaze charges $9 a month or $99 a year for unlimited data from one computer, with 30 days of version history by default and a year free when you switch it on. It runs in the background and you can test a restore from the website in two minutes.
• A second cloud with a bigger window. iCloud+ at 2 TB costs £8.99 a month; Dropbox Standard keeps 180 days of versions; Microsoft 365 for business pools OneDrive storage per user. Use it for a monthly copy of the folders that matter, kept separate from the daily sync account.

Protect the offsite copy with two-step verification and a password that is not reused anywhere. The NCSC lists that as the last step for a reason: a backup account that opens with the same password as the breached email is not offsite in any sense that matters.

The ransomware reality for firms that do and do not have backups

Sophos's State of Ransomware 2026 report, a survey of 2,158 organisations with 100 to 5,000 staff run between January and March 2026, found that 56% had data encrypted in an attack. Of those, 66% restored from backups and 48% paid a ransom, with a mean recovery cost of $1.70 million and a median of $375,000. In the UK sample, published in July 2026, the share paying fell from 54% in 2025 to 18% in 2026, while the share recovering from backups rose from 39% to 78%. Those are larger firms than most readers of this blog, but the direction is the lesson: the companies that paid were mostly the ones that could not restore.

The NCSC does not endorse paying. Its advice is the same for a two-person firm as for a hospital: keep recent offline backups, check you can restore from them, and scan the backup before you restore so you do not reinstall the problem.

The restore test nobody runs

Kaseya's 2025 backup report, drawn from more than 3,000 IT professionals, found that 60% believed they could restore within 24 hours but only 35% had demonstrated it, and that just 15% test backups daily and 25% weekly. A small business does not need daily tests. It needs a monthly one that takes ten minutes:

1. Pick one file you edited last week. Delete it from the laptop.
2. Restore it from the external drive. Open it.
3. Restore last month's version of a second file from the cloud backup. Open it.
4. Write the date and the result in a one-line log.

If either step fails, the backup was never a backup. Finding that out on a quiet Tuesday costs ten minutes; finding out after a theft costs the business.

The 20 minutes a week

• Monday, 5 minutes. Plug in the drive, let Time Machine or File History run, unplug it when the light stops.
• Monday, 5 minutes. Open the backup service and check the last successful run date and the size. A backup that has been "running" for three weeks is a backup that stopped.
• Monday, 5 minutes. Export anything that lives only inside a web app: the booking list, the CRM contacts, the shop orders. Drop the export in the backed-up folder.
• First Monday of the month, 5 minutes extra. The restore test above, and a check that the two-step verification codes for the backup accounts are still printed and findable.

How an AI agent helps you keep the rule

The hard part of 3-2-1 is not the technology. It is doing the same small thing every week for years. That is the kind of job an agent does without getting bored.

• Runs the weekly exports. Give the agent access to the booking tool, the CRM and the shop and it pulls the exports every Monday into the backed-up folder, and names them by date. Jobbit's automations run on a schedule without you opening a laptop.
• Checks the backup actually ran. It reads the backup service's status and tells you the date of the last good run, in a one-line message, instead of a dashboard you never open.
• Keeps the restore log. It reminds you on the first Monday, records the result, and flags a month that was missed.
• Writes the recovery plan. A one-page document: where each copy lives, which account restores it, who holds the codes, in the order you would need them on the worst day.
• Watches the retention windows. When Dropbox or Google changes a policy, or a subscription lapses, it tells you before the window closes.
• Drafts the notification if the worst happens. The ICO expects a breach report within 72 hours; the agent prepares the facts in the regulator's format while you deal with the business.

ChatGPT, Claude, Gemini, Microsoft Copilot, Manus and Meta's Muse will all explain backups and write a checklist. What they do not do is run the Monday routine for a year. A Jobbit agent runs the schedule, keeps the log and, when the job needs hands, brings in a vetted person from the network to set the drive up or recover the shop.

Your first week

• Day 1: make the list. The six categories above, with the folder or app each one lives in.
• Day 2: order the drive. 2 TB, from a known brand, and a labelled envelope for the recovery codes.
• Day 3: switch on the offsite copy. A backup service or a second cloud account, two-step verification on, the password in the manager.
• Day 4: first local backup. Let it finish, unplug, store.
• Day 5: first restore test. One file from each copy, logged.
• Day 7: set the Monday reminder, or hand the routine to the agent.

Read next

• Best Password & Privacy Tools in 2026 (1Password, Bitwarden, Proton & More)
• AI Scams in 2026: 9 Tricks Aimed at Small Businesses and How to Spot Each One
• 50 AI Automation Ideas for Small Businesses in 2026 (With Examples)

Frequently asked questions

What is the 3-2-1 backup rule?

Three copies of your data, on two different types of storage, with one copy kept offsite. The NCSC recommends it in those words. For a small business that means the working copy on the laptop and its sync folder, a weekly copy on an external drive that is unplugged afterwards, and an automatic copy with a cloud backup service or a second cloud account.

Is cloud sync like Google Drive or OneDrive a backup?

Only partly. Sync copies every change, including a deletion or an encryption, so it protects against a lost laptop but not against ransomware or a mistake you notice late. Google Drive keeps deleted files for 30 days and OneDrive for work keeps them for 93 days; after that they are gone. Treat sync as copy one and add the other two.

How often should a small business back up?

Continuously for the sync folder, weekly for the external drive and automatically every day for the offsite service. Test a restore once a month. The Kaseya 2025 survey found only 35% of organisations had demonstrated they could restore within a day, against 60% who believed they could.

How much does a small business backup cost?

About £85 to £100 once for a 2 TB external drive, plus $9 a month for Backblaze or £8.99 a month for 2 TB of iCloud+, at October 2026 prices. The operating system's backup software, Time Machine on a Mac and File History on Windows, is free.

Should I pay a ransomware demand if I have no backup?

The NCSC does not endorse paying, and payment does not guarantee the data comes back. In Sophos's 2026 UK survey 78% of firms that were hit recovered from backups and 18% paid, down from 54% the year before. The offline copy on an unplugged drive is the cheapest insurance against ever having to decide.

Can an AI agent manage my backups?

It can run the parts that need doing every week: the exports from web apps, the check that the backup service completed, the monthly restore reminder and the log. A Jobbit agent does that on a schedule, with 100 free credits a day and no card, and calls in a vetted person when the job needs someone on site.