What the three numbers actually mean
Three copies means the live data your staff work on plus two separate backups. The live copy does not count as a backup, because whatever happens to it (deletion, corruption, encryption by ransomware) happens to it instantly. Two backups exist so that if one fails quietly, which they do, you still have another to fall back on.
Two types of storage means the copies should not all sit on the same kind of device or service. A backup on a second hard drive inside the same server shares the same power supply, the same controller and often the same failure. Pairing a local device with a cloud service, or a cloud service with a different cloud provider, removes that shared weakness.
Why one copy has to leave the building
The offsite copy is the one that protects you from events that affect the whole premises: a fire, a burst pipe on the floor above, a burglary where the server and the USB drive next to it both walk out the door. Many offices discover after a break-in that their 'backup' was a portable drive sitting on top of the machine it was protecting.
Offsite used to mean someone taking a tape home on Fridays. Today it usually means an encrypted copy sent to a cloud data centre automatically every night. If you choose a provider with data held in New Zealand or Australia, ask where exactly, because some clients and contracts care about where information is stored.
The modern addition: one copy nobody can change
Ransomware changed the rule. Attackers now look for backups before they encrypt anything, and they delete or encrypt those too if they can reach them with the same admin password. That is why many people now talk about 3-2-1-1: the extra one is a copy that is immutable (locked so it cannot be altered for a set period) or fully offline.
In practice, that means a cloud backup with retention lock switched on, or a rotated drive that is physically disconnected once the job finishes. Either way, a criminal with control of your network still cannot touch it. Cyber insurers increasingly ask about this directly on renewal forms, so it is worth knowing which of your copies qualifies and being able to show the setting that proves it. If none of them does, this is usually the cheapest single improvement you can make to your recovery chances.
What 3-2-1 looks like in a ten-person office
A typical setup: files and email live in Microsoft 365, and a third-party service backs up every mailbox, OneDrive and SharePoint site each night to its own cloud. That gives you the live copy plus one independent backup offsite. If you also run a small server or NAS for an accounting database or design files, it backs up locally to a second device for fast restores and to the cloud for disasters.
Laptops are covered either by keeping all work in OneDrive (which is then backed up as above) or by an endpoint backup agent. The goal is that no important file exists only on one person's machine. Desktops in the office need the same thought: a reception PC that stores scanned documents on its own drive is a single point of failure that nobody notices until it dies. A quick sweep of each machine for locally saved work usually finds at least one surprise.
Setups that look compliant but are not
Several common arrangements tick the boxes on paper and fail when tested. Syncing a folder to OneDrive or Dropbox is not a second copy, because deletions and encrypted files sync straight across. A NAS that copies to a USB drive plugged into it permanently is one site and, often, one admin password. A cloud backup nobody has logged into since setup may have stopped months ago.
Another trap is backing up the wrong things. The shared drive is covered, but the accounting software keeps its data in a different folder, or the line-of-business app uses a database that needs its own backup method. Write down where every important system stores its data before deciding the rule is met.
How to check your own setup this week
List each place your business data lives: Microsoft 365 or Google Workspace, any server or NAS, laptops, and third-party cloud apps. Against each, write how many copies exist, where they are, and when one was last restored successfully. Gaps show up quickly in that table. Pay attention to the last column in particular. Many owners can say confidently that a backup exists, but far fewer can name the date of the last successful restore, and that date is the only real proof that the copy is usable.
If you would rather not do it yourself, the Office IT health check includes this exact exercise and gives you a plain list of what is missing. Whoever does it, the important part is that the answer comes from evidence, such as a recent restore, rather than from memory of how things were set up years ago.
In short
- Three copies, two kinds of storage, one offsite is the minimum for any business data you cannot recreate.
- Add one copy that is immutable or offline so ransomware cannot reach it.
- Sync and a permanently attached USB drive do not count as separate copies.
- Map every place data lives before deciding the rule is met.