Business Backups: The 3-2-1 Rule and How to Verify a Backup Actually Works

Almost every company says “we do backups.” And in nearly every other one, when it comes down to it, the last working copy turns out to be six months old, stored on the same server, or encrypted along with the original. Backup isn’t about “making a copy” — it’s about “being able to restore.” The difference is fundamental.

The 3-2-1 rule

The standard followed by everyone who has ever lost data:

• 3 copies of your data: the original plus two backups;
• 2 different types of media: for example, a server and a NAS, or a disk and the cloud;
• 1 copy off-site: in a data center, at a hosting provider, in another building.

Here’s why. A copy on the same server dies with the server. A copy on an external drive in the same office is lost in a fire, flood or theft — and gets encrypted by ransomware, because the drive is connected. An off-site copy survives all of that. In Tashkent, a convenient place for an off-site copy is a backup server in a local data center: data travels quickly over TASIX with no traffic charges, and the personal data localization requirement is met.

What to back up

1. 1C and other databases — using the database engine’s own tools (full + differential backups + transaction log), not by copying live files.
2. The file server — documents, contracts, projects. With versioning, so you can retrieve a file as it was a week ago.
3. Email — if it runs on your own server. In Microsoft 365 and Google Workspace, built-in retention is not a substitute for backup: an email deleted by an employee disappears after 30 days.
4. Configurations — of routers, switches, the phone system, and entire virtual machines. Restoring a server from an image takes hours; rebuilding it from scratch takes days.
5. Key employees’ workstations — accounting and management. A CEO’s laptop holding the only copy of the strategy is a reality at many companies.

How often

The real question is: how many hours of work are you willing to lose? If the answer is “no more than one business day,” a nightly backup is enough. If it’s “no more than an hour,” 1C and other databases need transaction log backups every 15–60 minutes, and files need hourly snapshots. This is your RPO, and it should be written into your contract with the provider.

The key point: testing restores

A backup that no one has ever restored from isn’t a backup — it’s a hope. Testing must be regular and documented:

• Daily, automatically — check that the job ran, the backup file exists and its size is plausible. On failure, the engineer gets an alert — not a log entry nobody reads.
• Monthly, manually — a test restore: the 1C database is brought up on a test server and opened, files are restored to a separate folder and compared. The result is a signed report with the date and time of the restore.
• Every six months — a drill: “the server is dead,” do a full restore on different hardware and measure the time. This is your RTO, and it often turns out to be twice as long as expected.

Five common mistakes

1. A copy on the same disk “in the Backup folder.” It dies with the original.
2. An external drive that stays connected. Ransomware sees it as a regular drive and encrypts it first.
3. The same password for the server and the backup storage. Once an attacker gets into the server, they delete the backups too.
4. No one watches the alerts. A job fails for months — and you find out on the day of the outage.
5. No configuration backups. The data is restored, but it takes a week to reconfigure the network and phone system.

What we do as part of managed services

Our Standard plan includes 3-2-1 backup setup, daily monitoring and a monthly test restore with a signed report. Off-site copies are stored in a partner data center in Tashkent. Learn more on the information security and backup page.