How to apply the 3-2-1-1-0 backup rule in a small UK office

3-2-1-1-0 is a practical backup model, not a rule set by a UK regulator. The NCSC describes the 3-2-1 approach and separately recommends isolated or offline backups and regular restore tests, but it does not use the combined label. Read the model as shorthand: 3 copies of important data, on 2 types of storage, with 1 copy off-site, 1 copy offline or otherwise isolated and immutable, and 0 errors after testing recovery.

The two additions to the older 3-2-1 rule exist because of ransomware. Attackers look for permanently connected storage and backup accounts, and encrypt or delete what they find. A copy that cannot be reached from a compromised office network, and a restore you have actually tested, are what turn a backup into a recovery plan.

Before choosing products, write down the data and system configuration you need to trade: customer and staff records, finance files, email, website content, shared business documents and the settings for your key systems. NCSC small-business guidance asks you to identify critical systems and assets first, because that list decides what gets backed up and how often.

Set the frequency by asking how much recent work you can afford to lose. NCSC suggests regular daily or weekly copies of essential information. If losing a day of invoicing and quotes would hurt, back that up daily. If a folder of archived contracts changes once a month, weekly or monthly copies are enough.

Three copies means the live data plus two backups. Two types of storage means the copies do not all sit on the same kind of medium, so one fault or one attack cannot remove them together. For a small office, a workable pairing is a local network storage device or external drive for fast restores, plus a cloud backup service for the second copy.

Cloud email and file platforms are not backups just because the data lives there. Deletion, sync of an encrypted file or an attacker with an admin login can remove it. Back up Microsoft 365 or Google Workspace data to a separate service, and keep version history on so earlier clean versions of files remain available after an infection.

The off-site copy protects against fire, theft and flooding at the premises. A reputable cloud backup service satisfies this, provided it holds the data in a different location from the office. The offline or immutable copy protects against ransomware: it is either disconnected from the network when not in use, or stored so that it cannot be altered or deleted for a fixed retention period, even by an administrator.

NCSC guidance recommends offline backups, copies in multiple locations, protected previous versions and restricted access to backup accounts. Enable MFA on every account that can reach the backups, and do not use the same credentials for backup administration as for daily work. Keep retention long enough to cover delayed discovery, because an infection that sat quietly for three weeks will have been backed up too.

A green status message from backup software shows the job ran, not that you can recover. Zero errors should mean a restore you carried out and recorded. NCSC says to test backups regularly and to know how to restore before an incident, so the first time you learn the process should not be during one.

Run a restore test every quarter. Restore a representative sample of files from each critical dataset, and where feasible restore one critical service or a single machine to a spare device. Test restoring from the protected copy as well as the local one, and check that the people who need to do this can reach the backup if the main systems are unavailable.

If your backups contain personal data, the ICO expects disaster-recovery and business-continuity arrangements that support timely restoration. It also asks you to consider whether backups are offline or segregated, who can alter or delete them, and whether changes or deletion would be detected. Your restore test record and access list answer most of those questions.

Backups also need a retention and erasure process. The ICO says a valid erasure request may require action on backup systems. Where immediate deletion is not technically possible, the data should be put beyond use and removed in line with an established schedule. Write down your retention period for each backup and how erased records are handled when a backup is restored.