Backups · Small business IT
The 3-2-1 Backup Rule for Small Businesses (2026): Websites, Microsoft 365 and Laptops
The rule is simple: three copies of your data, on two kinds of storage, with one copy off-site. Small businesses usually break it in the same three places. They treat Microsoft 365 or Google Workspace as a backup, they treat a synced laptop folder as a backup, and they have never restored anything. Here is how the rule maps to a website, a cloud office suite and a handful of laptops, plus exactly what our own hosting backups do every night.
The rule in one picture
Three copies means the live data plus two backups. Two kinds of storage means the copies should not share a single point of failure: not two folders on the same disk, and not a synced folder plus its own recycle bin. One off-site means another building, ideally another provider, so a fire, a flood, a stolen laptop bag or a failed data centre cannot take every copy at once.
The modern version adds two things. +1 is a copy that cannot be changed for a set time, either offline or immutable, so ransomware or someone with a stolen admin password cannot delete it. 0 means zero errors when you test a restore, which only counts if you actually test.
Your website
For a typical small business website, the three copies are the live site, the host’s off-site backup, and an export you keep yourself.
Here is what our hosting does, so you can compare it with your current host. Every night, the whole hosting server, including a fresh dump of every database, is copied to a separate off-site server with restic, an open-source backup tool that encrypts and de-duplicates the data. The retention policy keeps 14 daily, 3 weekly and 2 monthly restore points. After each run, a random 5% of the stored data is read back to prove it is intact and readable, not just written. Our managed VPS plans include 14 days of full backups.
That covers copy number two and the off-site rule. Copy number three should be one only you control. Our own plugin inventory, taken this week, shows why that matters: about two-thirds of the WordPress sites we host have a migration or export plugin installed, so the owner could download a full copy whenever they like. Under 5% run a scheduled backup plugin, and about a third have neither, relying entirely on the server backup. That is fine while the host is healthy and the account is in good standing. It is not fine as the only plan.
A monthly export to a drive in your office, or to cloud storage in a separate account, closes the gap. It takes ten minutes and it means a billing dispute, a lost login or a host going out of business cannot take your website with it.
Our NuGlass case study shows what happens without that third copy. The site had been compromised, there was no recent backup to restore from, and the previous host could not help. We rebuilt it from scraped content and cached references, cleaned the compromised code, and relaunched it on hardened hosting with daily off-site backups that are tested. It worked, but a tested backup would have turned a rebuild into a restore. Our WordPress security plugins guide explains why recovery is the layer that saves you when the others miss.
Microsoft 365 and Google Workspace
The most common backup assumption is that Microsoft or Google “has a copy”. They do keep your data available, and they keep deleted items for a while. They do not keep it forever, and they will happily sync a mass deletion or an encrypted folder.
- Microsoft 365: deleted email stays recoverable for 14 days by default, and an administrator can raise that to 30. SharePoint and OneDrive keep deleted items in a two-stage recycle bin for 93 days. A deleted user’s mailbox can be recovered for 30 days, and OneDrive can roll a whole library back to any point in the last 30 days. These figures come from Microsoft Learn.
- Google Workspace: Gmail and Drive keep deleted items in the trash for 30 days. After that, an administrator has 25 more days to restore everything deleted in a date range, not individual files, per Google’s admin help. Google Vault retains data for legal holds and eDiscovery; it can export, but it cannot restore files back into a user’s account.
A real backup for either suite is an independent copy, kept outside the tenant, with retention measured in months and the ability to restore one email or one file. Microsoft now sells its own Microsoft 365 Backup, and several independent tools do the same job; what matters is that shared mailboxes and SharePoint sites are included, not just personal mailboxes. If you are still choosing a suite, our Google Workspace vs Microsoft 365 comparison and Microsoft 365 plans guide cover the rest.
Laptops and the office
OneDrive folder backup, which syncs Desktop, Documents and Pictures to the cloud, is a good start. It is still sync: delete a folder on the laptop and it disappears from OneDrive too, and ransomware that encrypts files on the laptop encrypts the synced copies. Version history and OneDrive’s 30-day restore help, but they live inside the same account.
For the laptops that matter, the 3-2-1 version is the laptop itself, OneDrive or another sync service, and a separate backup: an external drive for quick restores, or a cloud backup service in an account that is not the same Microsoft 365 login. A file server or NAS in the office needs its own off-site copy; RAID inside the box protects against a failed disk, not against deletion, theft or ransomware.
The two extras: a copy nobody can change, and tested restores
Attackers who get into a small business now look for the backups first. If the same admin password can delete the backups, they will. The fix is a copy that cannot be changed for a set period, which most backup services sell as immutable storage, or a copy that is physically disconnected, such as a drive that goes home with the owner.
The other extra costs nothing but an hour. Restore something real every quarter, write down how long it took, and fix whatever surprised you.
- Pick one real file, one mailbox folder and one page of the website.
- Restore to a new location, never over the original.
- Time it. How long until the business could work again?
- Check the restored site loads, logs in and has the latest orders and forms.
- Confirm the off-site copy sits with a different provider or account.
- Confirm one copy cannot be deleted with the same admin password.
- Check shared mailboxes and SharePoint sites are in the Microsoft 365 backup.
- Check laptop backups cover Desktop and Documents, not just one synced folder.
- Write down who to call and where the backup account login is kept.
- Put the next test in the calendar, 90 days from today.
What we recommend today (30 September 2026)
This is the backup setup Metro Vancouver IT stands behind as of this date:
- Website: hosting with nightly off-site backups. Our WordPress hosting plans include them at $5, $15 or $35 CAD a month, and managed VPS plans from $59 CAD a month include 14 days of full backups. Add your own monthly export as the third copy.
- Updates and restore checks: WordPress Care at $90 CAD an hour; a monthly cycle typically takes about two hours ($180).
- Microsoft 365 or Google Workspace: an independent backup that includes shared mailboxes and SharePoint or shared drives, with at least a year of retention.
- Laptops: OneDrive folder backup plus a separate backup for anyone whose files would be expensive to lose.
- Everyone: one copy that cannot be changed, and a restore test every quarter.
If you want this handled for you, our managed IT services include off-site backups for servers, Microsoft 365 or Google Workspace, and websites, with restore tests you can see in the monthly report. If the worst has already happened and there is no backup, start with our hacked WordPress cleanup, billed at $90 CAD an hour, usually two to three hours.
Frequently asked questions
What is the 3-2-1 backup rule?
Keep three copies of your data: the live version and two backups. Store them on two different kinds of storage so one failure cannot take both, and keep one copy off-site, in another building or with another provider. Many businesses now add one copy that cannot be changed and zero untested restores, written as 3-2-1-1-0.
Is OneDrive, Dropbox or Google Drive a backup?
Not on its own. They sync, so deletions and encrypted files sync too. Version history and recycle bins help for a limited time, 93 days for SharePoint and OneDrive deletions and 30 days for Drive trash, but they live in the same account as the original. A backup is a separate copy you can restore from after those windows close.
Does Microsoft back up our Microsoft 365 data?
Microsoft protects the service against its own outages, and it keeps deleted items for a while: 14 days for email by default, 93 days for SharePoint and OneDrive. It does not keep a long-term copy you can restore from after a mass deletion, a departed employee or ransomware. That is what an independent Microsoft 365 backup is for.
Is RAID a backup?
No. RAID keeps a server or NAS running when one disk fails. Delete a file, get hit by ransomware or lose the whole box to theft or water, and RAID protects nothing. It belongs to uptime, not to the 3-2-1 count.
How long should we keep backups?
Long enough to notice a problem: at least 30 days of daily restore points plus several monthly ones. Backups are not the same as record keeping, though. The Canada Revenue Agency generally expects business records to be kept for six years from the end of the tax year they relate to, so keep those records in an archive, not just in rolling backups.
What is an immutable backup?
A backup that cannot be changed or deleted until a set date, even by an administrator. It protects against ransomware and against an attacker who steals an admin password and tries to wipe the backups before encrypting everything else.