Imagine opening your laptop on a Monday morning to find every file renamed to gibberish, a ransom note on your desktop, and a 72-hour countdown demanding $50,000 in cryptocurrency. Your accounting file, your client list, your payroll records, five years of tax returns — all encrypted. The attackers also found the external hard drive plugged into your office computer and encrypted that too. This is not a rare catastrophe. According to Verizon's 2025 Data Breach Investigations Report, ransomware figured in 44% of the breaches investigators examined, and small businesses are squarely in the blast radius because attackers know you have thinner defenses and no incident-response team on retainer.
Here is the part most owners miss: having a backup is not the same as being able to recover. Sophos's State of Ransomware 2025 survey of 3,400 organizations found that just 54% of ransomware victims recovered their data through backups — the lowest rate in six years — because modern ransomware deliberately hunts down and encrypts reachable backups before it announces itself. The average recovery cost, excluding any ransom paid, was $1.53 million. A backup that lives on the same network, under the same login, untested for a year, is not a safety net. It is a hope.
The fix is a decades-old discipline with a modern upgrade: the 3-2-1 backup rule, extended to 3-2-1-1-0 for the ransomware era. This post walks through what each number means, what CISA actually recommends for small businesses, and the monthly restore test that turns your backups from an assumption into a guarantee.
Start With an Inventory: What Can't You Operate Without?
CISA's first step for small-business backups is not buying software — it is identifying what your business cannot operate without. Backups are finite in budget and attention, so protect the crown jewels first:
- Financial records: your general ledger, invoicing history, payroll records, bank statements, and tax filings. Losing these does not just stall operations; it can make filing taxes or surviving an audit impossible.
- Customer and operational data: client lists, contracts, active project files, supplier agreements, and pricing records.
- System configuration: email archives, website content and databases, point-of-sale configuration, and credentials stored in your password manager (whose own emergency backup deserves a line in your plan).
- Legal and compliance documents: formation documents, licenses, insurance policies, and employee records.
Write the list down, note where each item lives today, and rank by how painful its loss would be. That ranking drives everything else: backup frequency, retention length, and how fast each category must come back online.
The 3-2-1 Rule, Decoded
The 3-2-1 rule is CISA's recommended baseline, and each number exists because a specific failure mode killed businesses that skipped it:
3 — Keep three copies of important files. One is your live working copy. The other two are backups. Two backups sounds redundant until the day your primary drive fails during the same week your single backup drive dies of old age. Independent failures happen together more often than intuition suggests, especially with hardware bought at the same time.
2 — Use two different types of storage media. For example, an external hard drive plus cloud storage, or a network-attached storage (NAS) device plus cloud. Different media fail differently: a power surge can kill every spinning disk in the office, but it cannot touch an off-premises cloud copy. A cloud provider outage cannot touch the drive in your desk drawer. Media diversity is protection against correlated failure.
1 — Keep one copy off-site, away from your business location. Fire, flood, burglary, and even a burst pipe above the server closet do not care how many copies you have if they all sit in the same building. Cloud backup is the easiest off-site copy for most small businesses; a rotated external drive stored at a second location works too.
Choose a solution that runs automatically on a schedule. Manual backups fail the way gym resolutions fail — reliably for the first two weeks, then never again. Automatic daily backups of critical data, with weekly full system images if you can afford the storage, is a sensible default for a small operation.
The Ransomware-Era Upgrade: 3-2-1-1-0
The classic rule predates ransomware that specifically targets backups. Two additions close the gap:
The extra 1 — one immutable or air-gapped copy. Immutable means write-once: the backup cannot be altered or deleted within a retention window, even by an administrator account. Air-gapped means physically or logically disconnected from your network — a drive that is unplugged after each backup, tape media, or cloud storage with object-lock enabled and separate credentials. CISA's ransomware guidance is explicit on this point: maintain offline backups, keep them encrypted, and make them immutable. The Sophos data shows why: organizations whose backups were compromised recovered far more slowly than those with intact copies. If your backup console logs in with the same credentials as everything else, assume the attacker owns it too — isolate backup credentials with their own strong password and multi-factor authentication.
The 0 — zero errors on restore verification. A backup that has never been restored is a hypothesis, not a protection. Corrupt archives, missing encryption keys, backups of the wrong folder, expired cloud credentials — every one of these is routinely discovered only at the moment of need. Zero means every scheduled backup completes cleanly and every scheduled restore test succeeds, with the results logged.
RPO and RTO in Plain English
Two planning terms show up in every serious backup guide, including CISA's. They are simpler than they sound:
- Recovery Point Objective (RPO) — how much data you can afford to lose, measured in time. If you back up nightly, your RPO is roughly 24 hours: a Friday afternoon failure costs you Friday's work. If losing a full day of invoices and orders is unacceptable, you need more frequent backups. Match backup frequency to how fast each data category changes.
- Recovery Time Objective (RTO) — how fast you must be back up. Can the business survive three days of manual workarounds while systems rebuild, or must point-of-sale and email be running within four hours? Your RTO decides whether a cheap "download everything from the cloud over the weekend" plan suffices or whether you need local copies and a practiced procedure.
Set both numbers per data category from your inventory, not one blanket policy. Financial records might warrant a 24-hour RPO and same-day RTO; archived marketing assets can tolerate far looser targets. Revisit the numbers annually — scheduled recovery tests are the moment CISA recommends refining them.
The Restore Test Most Owners Never Run
This is the single highest-leverage item in the entire backup discipline, and the one almost nobody does. CISA advises testing your backup procedure so your team can restore data both fully and partially, and can roll back data at least seven days — because ransomware often lurks undetected for days, quietly encrypting files that then get backed up over the good copies. Restoring yesterday's backup of already-encrypted files recovers nothing.
A practical monthly drill for a small business:
- Pick a test target — a single folder of real files, never the live system. Restore it to a separate location.
- Verify the contents — open the files. Confirm they are intact, current as of the backup date, and readable without hunting for a forgotten password or decryption key.
- Time the process — record how long a partial restore takes and extrapolate to a full one. Compare against your RTO. If the math fails, the plan fails.
- Test the full restore quarterly — rebuild one complete machine or one complete cloud workspace from backup. This is where missing drivers, unbacked-up configuration, and "we forgot the email archive" surface.
- Confirm the seven-day rollback — verify that versions from at least a week back exist and are restorable, so a slow-burn infection does not leave you with only poisoned copies.
- Document everything — who ran the test, what was restored, how long it took, what broke. Store the log where it survives the disaster it describes.
Then train the team. A backup plan that exists only in the owner's head fails the day the owner is unreachable. Write down the procedures — where backups live, how to start a restore, who to call — and make sure at least one other person can execute them.
Five Backup Mistakes That Keep Showing Up
Mistake 1: Treating cloud sync as backup. Dropbox, Google Drive, and OneDrive synchronize — when ransomware encrypts a local file, the encrypted version syncs to the cloud within minutes, overwriting the good copy. Sync services usually keep version history, which helps, but a short retention window plus a slow-burn infection equals no clean versions left. Sync is convenience; versioned backup with a real retention policy is protection. Use both.
Mistake 2: Leaving the backup drive connected. An external drive permanently plugged into the office PC is not an offline copy — it is a second victim. Ransomware enumerates connected drives as a matter of course. Rotate drives and disconnect them, or use immutable cloud storage.
Mistake 3: Backing up without encryption. Unencrypted backups are a breach waiting for a burglary or a lost drive — customer data, payroll details, and tax IDs in plaintext. Encrypt backups at rest, and store the decryption key separately from the backup itself (a sealed envelope in a safe, or a second password manager with its own emergency sheet).
Mistake 4: Backing up the wrong things. The classic discovery during a first restore test: months of faithful backups of the old server path, while everyone migrated to the new shared drive last spring. Audit backup scope whenever systems change — new software, new folders, new employees whose laptops hold the only copy of something.
Mistake 5: No offline access plan. CISA specifically calls this out: know how to reach critical files without an internet connection. If your only clean copy is in the cloud and the attack took down your network — or simply your router — you need a local offline copy and printed recovery instructions to get moving.
Your Books Deserve First-Class Protection
Financial records sit at the top of every backup-priority list for a reason: without them you cannot bill, cannot make payroll, cannot file taxes, and cannot prove anything to an auditor or an insurer. They also change daily, which means they need the shortest RPO in the building.
This is one quiet advantage of keeping your books in plain text. A plain-text ledger is a small file that versions beautifully: every change is a readable diff, every day's state is one commit away, and the entire history syncs to any off-site remote in seconds. Encrypted, versioned, multi-copy, restorable to any point in time — that is most of the 3-2-1-1-0 discipline falling out of the format itself, before you even configure a backup product. Whatever system you use, make sure the accounting data is explicitly in the backup scope, explicitly in the restore test, and explicitly in the seven-day rollback check.
Keep Your Finances Organized and Recoverable
As you put a real backup discipline in place, make sure the financial records at the heart of it live somewhere transparent and durable. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — version-controlled, portable across any backup medium, and trivially restorable to any point in history. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
