3-2-1 backup strategy in practice: no fluff, just what actually works

Backups are often discussed but rarely tested. The 3-2-1 strategy is a sound starting point: three copies of data, on two different media, one offsite. However, a strategy without a tested restore is just a belief that the backup works.

What 3-2-1 means in practice

• 3 copies: production + two backups
• 2 different media: e.g., local disk and cloud
• 1 copy offsite or out of administrator reach (offline / immutable)

Common mistakes

1. The backup runs, but the restore is never tested
2. The cloud backup is accessible with the same administrator account (ransomware deletes it)
3. Microsoft 365 data is not included (M365 is not a backup)
4. The backup covers servers, but not application databases
5. Retention is too long (costs) or too short (insufficient security)

Microsoft 365 is not a backup

Microsoft guarantees that data will not be lost due to their error. They do not guarantee that a user will not delete a folder or that an attacker will not encrypt OneDrive. For email, OneDrive, SharePoint, and Teams, it makes sense to have a separate backup solution.

Restore test

At least once every few months, restore a random file, a mailbox, and (by agreement) an entire server into a test environment. Record how long it took. This is the only real indicator that the backup works.