3-2-1 Backup for Small Business: How to Set Up Without a Sysadmin

The 3-2-1 backup is the simplest data protection rule there is: three copies of your files, on two different types of media, with one copy off-site. A small business can set up 3-2-1 backup without hiring a full-time sysadmin. This guide shows you how, what it costs in 2026, when the rule isn't enough, and the pitfalls we see in those who think they already have a backup.

TL;DR

• 3-2-1 = 3 copies, 2 different media types, 1 off-site. Synchronization (Google Drive, OneDrive, Dropbox) does not count as one of these copies.
• Today's ransomware target is the backup itself. Veeam reported that 96% of 2024 attacks targeted backup repositories. That's why the off-site copy needs to be immutable or offline.
• Object cloud storage costs from $6.95 per TB/month (Backblaze B2) and $7.99 per TB/month (Wasabi, since July 2026). For most SMBs, the monthly bill is less than a team lunch.
• A backup that has never been restored is a hypothesis, not a backup. Test restoration at least once per quarter.
• Setup takes 2 to 4 weeks. What requires specialized expertise is the initial design and restoration testing, not daily operation.

I am Cleverson Gouvêa, founder of Agathas Web. Since 2008, I've managed Linux servers, managed hosting, Moodle environments for educational institutions, and, in recent years, the infrastructure behind the official WhatsApp API. Backup is the least glamorous part of this job and the one that weighs most heavily on a bad day. The prices and data in this text were verified in October 2026, with the indicated sources.

What is 3-2-1 Backup and Why It's Still Valid in 2026

The rule fits in one sentence, but each number has a reason.

• 3 copies: The original data plus two copies. If one fails, two still remain. The chance of three independent copies dying at the same time is much lower than for a single one.
• 2 different media types: Server disk and a NAS, for example, or NAS and cloud. Different media types don't share the same manufacturing defect, the same controller, or the same lightning strike on the power grid.
• 1 off-site: Fire, flood, theft, and ransomware don't respect the server room door. The off-site copy survives the worst day at the office.

CISA itself, the U.S. cybersecurity agency, recommends in its official ransomware guide to keep critical data backups offline and encrypted and regularly test the availability and integrity of these copies. The reason is stated clearly: many ransomware variants seek out and delete or encrypt backups they can reach.

That's where the classic 3-2-1 backup shows its age. It was designed for hardware failure and physical disaster. The 2026 attacker enters through the network, with stolen credentials, and deletes copies before demanding a ransom. That's why the modern version of 3-2-1 backup gained two more numbers.

The Evolution: 3-2-1-1-0

• +1 immutable or offline copy: A copy that no one can delete or alter for a period, not even with administrator credentials.
• 0 verification errors: Restoration has been tested and worked.

This isn't vendor marketing. The 3-2-1 backup with these two additions is the direct answer to how attacks happen today.

Why Ransomware Targets Backup First

Market report numbers are clear about the target.

• Veeam's Ransomware Trends Report 2024 indicated that 96% of ransomware attacks targeted backup repositories and that, in 76% of cases, the attacker managed to compromise part of these copies.
• Sophos, in a 2024 study on compromised backups, showed that 94% of attacked organizations saw attempts against backup, and that companies with compromised backups spent about 8 times more on total recovery than those with intact backups.
• Verizon's Data Breach Investigations Report 2026 recorded ransomware in 48% of analyzed breaches.

Translating for small businesses: attackers know that with a clean backup, you won't pay. So the first thing they do after gaining access is look for the NAS mapped as a network drive, the external hard drive that stays plugged in 24 hours a day, and the cloud service panel with the same password as your email.

In the day-to-day management of servers, the risk pattern repeats: the backup exists, runs every night, and is accessible by the same user who has access to everything. If that user is compromised, the backup is compromised too. That's why Linux server hardening and two-factor authentication for businesses go hand-in-hand with backup. One protects the door; the other ensures there's life after the door has been breached.

The Most Common Mistake: Thinking Synchronization Is Backup

Before setting anything up, it's worth debunking the belief we most often see in small businesses: "it's all in Drive, so I have a backup."

Google Drive, OneDrive, and Dropbox are synchronizers. They quickly copy changes from one side to the other. If ransomware encrypts a folder on your computer, the encrypted version is synchronized to the cloud. If someone deletes a folder, it disappears everywhere.

It's true that these services keep old versions and a trash bin for a while. This helps with small accidents. It does not replace, within a true 3-2-1 backup, an independent copy, with retention you control, stored outside the compromised account.

The same applies to email and documents within Microsoft 365 or Google Workspace. Microsoft's Services Agreement expressly recommends that customers regularly back up their own content. The provider guarantees the service works; the data is your responsibility.

What Counts as a Copy in 3-2-1 Backup

Item	Counts as a copy?	Why
Synchronized folder in Drive/OneDrive	No	Replicates deletions and encrypted files
RAID on server or NAS	No	Protects against disk failure, not against deletion or ransomware
Snapshot of the same volume	Partially	Helps to go back in time, but dies with the equipment
NAS with version history	Yes	Second media, local, with retention
Object cloud storage with Object Lock	Yes	Off-site and immutable
Disconnected external hard drive stored off-site	Yes	Offline, but depends on human discipline

How to Set Up 3-2-1 Backup in a Small Business, Step-by-Step

Setting up 3-2-1 backup involves four steps. None requires a dedicated full-time person; it requires someone who can design it once and a responsible party who reviews the report weekly.

1. Inventory: What You Can't Afford to Lose

List the data that, if it disappeared tomorrow, would halt your business. Typically, these include:

• ERP database, management system, or e-commerce;
• project folders, contracts, and tax documents;
• email inboxes;
• the website and its database;
• for educational institutions, the entire Moodle: database, moodledata, and code.

For each item, define two numbers: how much work time you can afford to lose (RPO, Recovery Point Objective) and how long you can be down (RTO, Recovery Time Objective). An accounting firm might accept losing a day's work; an e-commerce store during Black Friday would not.

2. Local Copy: Fast, for Everyday Problems

The second copy stays close: a NAS with version history or a backup server on the same network. This is what you use to restore a file accidentally deleted on Tuesday. It needs to be fast, because 90% of restorations are small.

Careful considerations that make a difference:

• the NAS should not appear as a mapped network drive on team computers;
• the user account that writes the backup should not be the same as the everyday user account;
• activate version history and keep at least 30 days.

3. Off-site and Immutable Copy: The One That Saves You on Attack Day

The third copy of the 3-2-1 backup goes off-site. In 2026, the cheapest and least discipline-dependent path is S3-compatible object storage with Object Lock, the feature that locks each file against deletion for a defined period. With Backblaze B2, for example, the retention period can be extended but not shortened. Neither you nor an attacker with your password can delete it before expiration.

Mature and free tools handle encrypted uploads: restic (version 0.19.1, as of July 2026), BorgBackup, and rclone on Linux; solutions like Veeam Agent in Windows environments. Encryption happens before the data leaves your company, and you retain the key.

A real technical pitfall: not every tool plays well with Object Lock. Old version cleanup routines try to delete locked files and fail. Backblaze itself warns that simple synchronization tools often break the job when they encounter an immutable object. Test the tool + locked bucket combination before relying on it.

4. Scheduling, Alerts, and Accountability

Backup without alerts dies in silence. Configure:

• automatic execution outside business hours;
• email or message when the job fails and, even better, when it doesn't run;
• a named responsible party who checks the weekly report.

It's the cheapest and most forgotten step. The classic scenario is a backup that stopped running months ago, and no one noticed until they needed it.

How Much Does 3-2-1 Backup Cost in 2026?

The monthly cost of 3-2-1 backup often surprises people on the low side. What's expensive is lost data.

Component	Price Reference (Oct/2026)	Note
Backblaze B2	$6.95 per TB/month	10 GB free; free egress up to 3x stored volume
Wasabi Hot Cloud Storage	$7.99 per TB/month	New price since 07/01/2026 for pay-as-you-go
2-bay NAS + 2 drives	one-time investment	Varies greatly by capacity and brand; check local market
Software (restic, Borg, rclone)	free	Open source, no per-machine license

A practical example: a company with 500 GB of critical data and 90 days of retention rarely exceeds 1 TB stored in the cloud, because modern tools deduplicate and only send what has changed. This comes out to less than $10 per month on Backblaze B2. Always check the official B2 pricing page before finalizing your budget.

The cost that doesn't appear on the spreadsheet is for labor hours: designing, configuring, testing the first restoration, and documenting. This is where small businesses stumble, because no one on the team has that time or expertise.

When 3-2-1 Backup Isn't Enough (and When It's Overkill)

The rule is a floor, not a ceiling. And it doesn't need to be applied to everything with the same rigor.

When It's Not Enough

• Systems that cannot go down. Backup recovers data; it doesn't keep the system running. If an hour of downtime is costly, you need replication or a contingency environment, in addition to backup.
• Databases with many transactions. Copying the database file while it's running generates a corrupted copy. Use consistent dumps or snapshots coordinated with the database.
• Personal data under privacy regulations. Backup also contains personal data. It requires encryption, access control, and a defined retention period. In the event of an incident involving personal data, you must comply with relevant privacy laws regarding notification to affected individuals and regulatory bodies.

When It's Overkill

• Files already residing in a system with vendor backup and that you can recreate. Temporary spreadsheets and downloads don't need three copies.
• Test environments. Store the code in the repository and the creation script; don't perform daily backups of disposable machines.
• Large volumes of cold data. Archived data can go to a cheaper, slower archiving tier, with annual restoration testing.

Knowing what not to copy reduces costs and makes backing up what matters faster.

Restoration Testing: The "0" Almost No One Does

A backup that has never been restored is a promise. In 3-2-1 backup, testing is what transforms that promise into a guarantee.

A simple routine that works for SMBs:

1. Monthly: Restore a random file from a critical folder and check if it opens.
2. Quarterly: Restore an entire system (the ERP database, the website, Moodle) in a separate environment and time it. This time is your real RTO, not the one on paper.
3. Annually: Simulate the worst day. Assume the server and NAS are gone. Can you recover with only the off-site copy? Who has the encryption key? Where is the password?

That last question derails more plans than any technical failure. An encryption key stored only on the lost server renders the off-site backup useless. Store it in a company password vault and a physical copy in a secure location.

In Moodle backup, this becomes clear: a restored course without the corresponding moodledata opens empty. Only a full test reveals this kind of gap.

Pitfalls We See in Small Businesses

• External hard drive always plugged in. It just becomes another drive for ransomware to encrypt.
• One password for everything. The cloud backup account with the same password as email and no second factor.
• Server-only backup. The director's laptop, with the month's contracts, is left out.
• Too short retention. Attacks lie dormant for weeks before encrypting. With only 7 days of history, all copies are already contaminated.
• No one owns it. The technician who set it up left, and the alert goes to an email no one reads.
• Relying on RAID. RAID protects against disk failure. It does not protect against deletion, human error, or attack.

If you recognized two or more items on this list in your company, the problem isn't the tools. It's design and accountability, which is exactly what an independent technology consulting firm with a diagnostic approach solves before an incident, not after.

How Agathas Web Solves This

Most small businesses don't need a hired sysadmin to have a real 3-2-1 backup. They need someone to design it correctly once, test it together, and make the operation simple enough for the team to manage.

In Agathas Web's consulting services, backup and recovery are among the vectors we audit in every diagnostic, along with security, access, and data privacy compliance. In practice, it works like this:

• Free initial consultation of 30 to 60 minutes to understand your scenario, systems, and what's critical.
• Technical deep dive with read-only access: we map where your data is, how backup runs today, who has access, and if restoration actually works.
• Action plan report: what to keep, what to fix, the recommended 3-2-1 architecture for your size, estimated monthly cost, and 30-day quick wins.
• Implementation and restoration testing, if you want us to execute it, or monthly follow-up in a CTO as a Service format, for your team to execute with senior review.

The work is led by a company partner, with over 15 years of experience operating servers, Moodle in production, managed hosting, and integrations with the official WhatsApp API. We do not resell backup software, so our recommendation is what serves you, not what pays commission. The work begins with a bilateral NDA.

Conclusion: 3-2-1 Backup is Affordable; Losing Data Isn't

3-2-1 backup remains the right foundation for small businesses in 2026, provided it's updated for today's attacks: an immutable or offline copy, separate access credentials, and scheduled restoration testing. Object cloud storage costs just a few dollars per terabyte, and the best tools are free. What's missing for most SMBs isn't budget; it's proper design and accountability.

Start with this week's inventory: list what cannot be lost and ask when the last restoration was tested. If the answer is "never" or "I don't know," schedule a diagnostic with Agathas Web and leave with a backup plan you can prove works.