I tell clients this all the time: ransomware is often a backup failure before it’s a security failure.
Yes, the intrusion matters. Yes, hardening, MFA, patching, EDR, and email controls matter. I spend plenty of time on those. But when I see a small business go from “incident” to “crisis,” it’s usually because the only usable copy of their data was the one the attacker just encrypted.
That’s why the 3-2-1 rule still holds up.
Three copies of your data. Two different types of storage. One copy offsite.
It’s not flashy. It doesn’t sell like the latest detection platform. But in the real world, it’s one of the few controls that consistently changes the outcome.
For a small business, this does not need to be complicated. In most cases, I’d rather see a simple backup routine that actually runs than an elaborate architecture nobody maintains.
A practical baseline looks like this:
- the working copy on the laptop or workstation
- a local backup, like an external SSD or NAS
- an offsite copy in cloud storage or backup service
That gets you most of the way there. The part people miss is that connected backups are not automatically safe backups.
Modern ransomware doesn’t stop at the Documents folder. It looks for mapped drives, attached storage, network shares, and anything else it can encrypt or delete on the way out. I’ve seen businesses feel confident because they had a backup drive, only to learn it was mounted the whole time and got hit too.
So if you want backups that are meaningfully resilient against ransomware, one copy needs to be harder for the attacker to touch.
That usually means some mix of:
- an offline backup that is disconnected after the job runs
- cloud version history so encrypted files can be rolled back
- immutable storage or retention lock so backups can’t be altered or deleted
That last point matters more than most people realize. A lot of “backup” setups are really just sync with better branding. If the bad files sync everywhere, you don’t have recovery — you have synchronized damage.
Another point I push hard in client conversations: if the backup depends on memory, it will eventually fail.
The number of times I’ve heard “we back up regularly” only to find out it means someone plugs in a USB drive when they remember… that story never ends well. Automation is what turns good intentions into an actual control.
And then there’s restore testing, which is where a lot of backup confidence goes to die.
A backup you’ve never restored is just a theory. I’ve seen jobs backing up the wrong folder, expired credentials break cloud backups silently, and restore workflows nobody had ever timed or validated. Quarterly restore tests are usually enough for a small business to catch most of this before an attacker does.
If I were boiling this down for a UK small business owner or freelancer, I’d keep it very simple:
Know what matters. Back it up automatically. Keep one copy out of reach. Test that you can restore it.
Also worth saying plainly: sync is not backup, a second folder on the same machine is not backup, and a stale USB stick from two years ago is not backup.
If ransomware hits before you’ve cleaned this up, the priorities are straightforward: isolate the device, stop the spread, don’t rush to pay, preserve evidence, and rebuild from known-good copies if you have them. But the real work happens before that day.
I’m not interested in fear-based security advice. Most small businesses do not need enterprise-grade complexity here. They need a backup routine that survives real-world failure modes: ransomware, accidental deletion, hardware loss, theft, and plain old human forgetfulness.
That’s what the 3-2-1 rule gives you. Not perfection. Just a very practical way to make extortion far less effective.
If you run a small business and haven’t checked your backups lately, this is a good week to do it. Future you will care a lot more about restoreability than backup theory.