The 3-2-1 Backup Rule: Protect Your Business Data Before the Year Ends

Typhoon Paeng Just Reminded Us: One Copy of Your Data Is Zero Copies

A week ago, Severe Tropical Storm Paeng pushed floodwater through offices, shops, and homes across Luzon, the Visayas, and Mindanao. Picture the two things sitting in the same drawer of one of those offices: the accounting PC, and the external drive somebody labeled "the backup." Both are gone. That is the entire argument for the 3-2-1 backup rule, and November is the right month to finally apply it.

Paeng, known internationally as Nalgae, made landfall in Catanduanes on October 29 and brought heavy rain, flooding, and landslides in the days that followed. After water like that, the loss list for a small business is predictable: stock, equipment, and the one computer that held everything.

November is also housekeeping month for Philippine SMEs. You are closing the books, getting records in order for year-end BIR compliance, counting inventory, and sketching a 2023 budget. Add one line to that checklist: audit your backups.

We handle server and backup work for clients around Laguna and Metro Manila, and the most common data-loss call we get is not about hackers. It is a five-year-old drive that stopped spinning on a Monday, or a shop that took water up to the counter. One decades-tested standard survives both, and it fits on a sticky note.

What Is the 3-2-1 Backup Rule?

The rule is three numbers:

• 3 copies of any important file: the one you work on, plus two backups.
• 2 different media types, so both backups are not sitting on the same kind of storage.
• 1 copy offsite, in a different physical location from the original.

That is how US-CERT frames it in its guidance paper Data Backup Options, written with Carnegie Mellon University. The rule was popularized by photographer Peter Krogh in his book on digital asset management and later recommended by US-CERT.

Make it concrete. Say you run a bakery in Biñan: your critical data is the point-of-sale database, the payroll spreadsheets, and the scanned BIR receipts your bookkeeper needs each quarter. Walk the payroll file through the three numbers.

The number	What it means for that one payroll file
3 copies	Live file on the office PC, nightly copy on an external drive, copy in the cloud
2 media	The PC's internal drive is one type; the external drive or cloud account is the second
1 offsite	The cloud copy sits outside the building and survives whatever hits it

Each number solves a different problem: three copies survive a deleted or overwritten file, two media types survive one kind of failure such as a power surge, and one offsite copy survives a disaster that claims the whole address. Setting that up properly is the daily work of our server and backup infrastructure services, but the rule itself is something any owner can check in an afternoon.

3 Copies: Why the "Backup" on the Same Computer Doesn't Count

One primary copy plus two backups. The word people get wrong is "copies," because two files on the same disk are really one copy wearing two names. When the drive dies, both go. When ransomware encrypts the machine, both go.

Here is what we usually find in small offices, and why each is really one copy:

• A lone USB flash drive in the cashier's drawer, updated whenever somebody remembers.
• An external hard drive plugged in 24/7, sharing the same outlet, surge, and flood as the computer.
• A "backup" folder on drive D: of the same physical machine.

Then the trap almost everyone falls into: sync is not backup. Google Drive, Dropbox, and OneDrive keep a folder identical everywhere, and that is exactly the problem. Delete a file by mistake and the deletion syncs; open a corrupted file and the corruption syncs. Sync gives you the newest version everywhere; backup gives you an older version you can go back to.

For a micro-business the starter setup is cheap: one external drive for a scheduled nightly copy, plus one cloud account for the offsite copy.

2 Media Types: Mix Local Drives, a NAS, and the Cloud

"Different media" means storage that fails for different reasons. An internal drive plus an external USB drive counts; so does a local drive plus a NAS, or a local drive plus cloud storage. Two identical externals bought the same day and kept on the same shelf? That is one media type with two serial numbers.

A NAS, or network-attached storage, is a small box of hard drives on your office network that every computer can save to; Synology and QNAP class units are common in offices your size. If you run an on-premises server, Windows Server Backup is already built in. Cloud storage, whether Google Drive, Dropbox, OneDrive, or object storage like Amazon S3, is a medium that is not in your office at all.

Separate two kinds of backup while you are at it. File-level backup copies documents, spreadsheets, and databases, which is what most offices need. Image-level backup captures the whole machine, operating system and settings included, so a dead server comes back without being rebuilt from scratch. We walked through that in our guide to backing up your Windows Server to a virtual hard disk.

One caveat we repeat constantly: RAID, or redundant array of independent disks, is not a backup. It keeps a server running when one disk fails, but it mirrors every deletion and every encrypted file across the array, and it drowns as fast as the rest of the office. RAID buys uptime. Backup buys recovery.

1 Copy Offsite: Floods, Fires, and Ransomware Don't Respect Your Server Room

This is the number people skip, and the one Paeng just tested. Floodwater does not choose between the PC, the NAS, and the drive on the shelf above them. Everything inside the building shares one fate.

Ransomware, malware that encrypts your files and demands payment for the key, works the same way. It does not stop at the machine it landed on; it reaches attached backup drives and mapped network shares, which is why a permanently plugged-in drive is not the safety net you think it is. An offline or offsite copy is your last line of defense once prevention fails.

Prevention still comes first. In a memorandum dated September 12, the NTC ordered Globe, Smart, and DITO to block malicious links sent by SMS, amid this year's surge in smishing, which is phishing delivered by text message. That same climate produced the newly signed SIM Registration Act. Read up on firewalls as your network's first line of defense and on spotting phishing red flags before they cost you. Just remember that prevention and recovery are different jobs, and backup is the recovery half.

For most SMEs the cloud is the practical offsite copy, because it needs no second office. One budgeting note: the peso closed at a record low of P59 to the dollar on October 3, so dollar-priced storage costs more pesos this year than ever, though a few hundred pesos a month is still nothing against rebuilding two years of books from memory. Designing that copy properly is what our cloud computing and cloud backup services are for.

There is a legal angle too. Under Republic Act No. 10173, the Data Privacy Act of 2012, approved on August 15, 2012, businesses holding personal data about customers and employees must protect it with organizational and technical measures. Losing payroll or customer records in a flood is not only an operational disaster; it is a compliance problem you will have to explain.

Your 30-Minute Year-End Backup Audit (Do It Before the Holiday Rush)

You can do the first pass yourself, today, in about half an hour:

1. List your critical data. Accounting files for BIR, payroll, the POS or inventory database, customer records, signed contracts. If losing it stops you from operating or reporting, it belongs on the list.
2. Map each item against the 3-2-1 backup rule. How many copies exist, on how many media types, and is any of them outside the building? The gaps show up in minutes.
3. Restore one file. Actually pull it back and open it. A backup nobody has restored from is a hope, not a backup, and this step catches the empty drive and the job that quietly stopped running in March.
4. Automate the schedule. Anything that depends on someone remembering will not survive December.
5. Name one person accountable. One owner, one weekly check that the last backup completed.
6. Write down where every copy lives. Which drive, which cloud account, which login, and make sure a second person can find that note.

Do this before the Christmas rush, not after. December is when staff are stretched thinnest and data changes fastest, and nobody wants to find a dead backup drive on January 2 while assembling year-end reports.

To be straight with you: the 3-2-1 backup rule is the floor, not the ceiling. Run several servers or hold regulated records and you also need retention policies and a real disaster-recovery plan, which is a conversation rather than a blog post. But most businesses we meet are still at the "one drive in a drawer" stage, where 3-2-1 is the biggest single improvement available.

Before you close the books on 2022, give your backups the same audit you give your inventory. If you would rather have a second pair of eyes, we do backup and server infrastructure reviews for small businesses across Laguna and Metro Manila. Book a quick call and we will map your data against the 3-2-1 rule together, with no hard sell.