3-2-1 Backup for a Cloud-First Small Business

The 3-2-1 rule was written for file servers. What three copies and two media mean when you own no hardware — and the copy almost every small team is missing.

By the founder — infrastructure engineer, 15 years (bio) · Updated 2026-08-11

Three copies of your data, on two different kinds of storage, with one off-site. Every backup article recites it. Almost none of them says what it means for a business whose data lives in Google Workspace, a CRM, and an accounting tool — where you own no servers, no tape drive, and possibly no office.

The rule still works. It just needs translating, and the translation exposes a gap most small teams have without knowing it.

If you’re not yet convinced backup is separate from sync, start with cloud storage is not a backup — this guide assumes you’re past that argument and want to build the thing.

First, write down where your data actually is

You can’t apply the rule to data you haven’t located. Cloud-first businesses have four buckets, and people usually only think about the first two.

1. Laptops and desktops. Local files, desktop app data, downloads folders where things quietly live for months.

2. Your productivity suite. Google Workspace or Microsoft 365 — mail, calendars, Drive or SharePoint, shared team folders.

3. Your business SaaS. CRM records, accounting ledgers, invoices, e-signature archives, form submissions, project history. This is often the data you’d least like to lose and the data with no backup at all.

4. The awkward remainder. Your website, your DNS zone, code repositories, design files, the shared password vault. Small, easy to forget, painful to reconstruct.

Take ten minutes and list yours. The account inventory template already has a column for what data each tool holds, which is the same list from a different angle.

Translating “two different media”

The original rule meant don’t keep both copies on the same kind of hardware — because if one disk technology or one controller fails, correlated failures take both.

You own no hardware. So the useful modern reading is: two independent failure domains. Two copies must not share a provider, an account, or a credential. If a single compromised Google admin account, a single billing lapse, or a single vendor outage can reach both copies, you effectively have one.

That reframing matters because it rules out things that look like compliance:

• Drive plus Drive’s own version history — same provider, same account. One copy.
• Two folders on the same laptop. One copy.
• A backup tool that authenticates through the same Google SSO you’re trying to protect against. Arguably one copy.

Building the three copies

Copy 1 — the working data. Where you use it. Drive, SharePoint, your CRM. This is not a backup, it’s the thing being protected.

Copy 2 — an independent backup, different provider, different credentials. For endpoints, that’s a cloud backup service running continuously in the background. For your suite and SaaS, it’s a dedicated backup product for those platforms, which is a different category from laptop backup and priced separately.

Copy 3 — off-site relative to copies 1 and 2, and ideally offline. For a cloud-first shop the pragmatic version is a periodic export to an external drive kept somewhere else: a full data export from your suite, plus CSV exports of your CRM and accounting. Quarterly is plenty. Its purpose isn’t convenience — a drive in a drawer cannot be reached by a compromised credential or a billing dispute, and that’s the whole point.

Copy 3 is the one people skip because it’s manual. It’s also the only one that survives losing access to your accounts entirely.

The copy almost nobody has

Endpoint backup protects laptops. It does not back up your Google Workspace or Microsoft 365 tenant, and it does not back up your CRM.

This is the single most common gap in small-business backup, and it’s structural: you buy laptop backup, it works, you reasonably assume you’re covered. But if a mailbox is deleted, a shared drive is wiped by someone with permissions, or an admin account is compromised, laptop backup has nothing to restore from.

Two things worth being precise about here:

Your suite’s retention and eDiscovery features are not backups. Google Vault and Microsoft’s retention policies are governance and legal-hold tools. They can help you recover in some scenarios, they’re typically only on higher plan tiers, and they live inside the account you may be locked out of. Check what your plan actually includes before assuming it covers you.

For most SaaS, the honest fallback is scheduled exports. Dedicated backup products exist for the big suites; for a five-person CRM they’re often more product than you need. A recurring calendar reminder to export your CRM and accounting data to that off-site drive is unglamorous and works. We haven’t tested the SaaS-backup products, so we’re not naming one — see below.

What it costs

From our verified pricing, checked 2026-07-30, for endpoint backup at five machines:

Three genuinely different shapes, and the cheapest headline isn’t automatically the best fit:

• Backblaze is per computer and unlimited. Predictable, and it doesn’t care how much data you have. A team where everyone has a laptop and a desktop pays twice — this is per machine, not per person.
• IDrive pools the quota. Dramatically cheaper at the same head-count, but 5 TB shared five ways is a real ceiling, and one person with a large photo or video library can consume it.
• Acronis buys per-machine licences, and its 5-computer licence at $169.99/yr is far better value than five singles at $72.99 each.

We are not ranking these. Our backup reviews are still in the lab, including timed full restores, which almost no published review actually performs. When a product’s headline price is a quarter of a competitor’s, the differences that matter — restore speed, whether bulk restore works, what happens at the quota ceiling — are exactly the things you can’t learn from a pricing page. You can follow the public test log for when those runs land.

Test the restore, or you don’t have a backup

Backups fail quietly. The job reports success, the dashboard is green, and the archive has been silently skipping a folder for eight months.

Twice a year, forty minutes:

1. Restore one file from roughly three months ago. Confirm it opens.
2. Restore a whole folder. This is the one that finds problems — per-file restore working tells you nothing about bulk restore.
3. Time it. Note how long it took and extrapolate. If a 2 GB folder took twenty minutes, your 400 GB disaster recovery is measured in days, and that changes what you’d actually do in an incident.
4. Restore from your off-site copy too, at least once a year. Plug in the drive and open something. Drives in drawers die unread.
5. Write down the date. In your inventory, in a calendar entry, anywhere. An untested backup and a tested one look identical until the day they don’t.

What 3-2-1 does not protect you from

Worth stating plainly, because backup gets sold as though it solves more than it does:

• Losing access to your accounts. If your Google admin is compromised or your billing fails, copies 1 and 2 may both be unreachable. Only copy 3 answers this.
• Slow-burn corruption. If a file was quietly damaged five months ago and your retention is 90 days, every copy you hold is the damaged one.
• A breach. Backup restores availability, not confidentiality. Restoring from backup doesn’t undo data having been exposed — that’s a separate problem, and if a device was involved, our stolen-laptop guide covers the first hour.
• Obligations. Having a backup is not the same as meeting a contractual or regulatory retention requirement. Read what you’ve actually committed to.

The version that fits on a sticky note

If you do four things you’re ahead of most small businesses:

1. Cloud backup running on every laptop, verified enrolled — not assumed.
2. A plan for your suite and SaaS data that isn’t “the vendor probably keeps it.”
3. A quarterly export to an external drive kept somewhere else.
4. A restore test twice a year, with the date written down.

None of that requires a consultant, and the total for a five-person team lands somewhere between $10 and $45 a month plus the cost of one external drive.

Pricing figures are verified list prices from each vendor’s official pricing page on 2026-07-30 — see the pricing tracker for sources and check dates. We have not completed hands-on testing of these backup products and do not rank them here. This page contains no affiliate links.