Backups: the 3-2-1 rule for a small business

The rule

• Three copies of your data: the original plus two backups.
• Two different media: for example the computer’s own disk and an external drive. An external drive and online storage work too.
• One copy off site: a fire or a burglary takes everything kept in the same place.

There is nothing technical about it and that is its strength. It fits on a sticky note. It also covers most of the failures a small business runs into.

What it does not cover on its own

Ransomware encrypts everything it can reach. That includes the backup drive that stays plugged in and the folder synced to the cloud. Syncing is not backing up: it copies the destroyed files as well.

Hence two additions:

• a disconnected copy, meaning a drive you unplug after each backup. Online storage can also do the job if it keeps older versions without letting anyone delete them;
• several versions over time: if a file has been damaged for three weeks, yesterday’s backup is no use.

The test almost nobody runs

A backup you have never restored is an assumption. Once a quarter, pick a file at random and restore it on another computer. Once a year, restore everything. It is the only way to know the copy is complete and readable.

For accounting, more is at stake than a breakdown: books and supporting documents must be kept for ten years (art. 958f CO). A backup you cannot read in five years is as bad as a lost one.

A concrete example

1. 01Working data on the office computer.
2. 02An automatic backup every evening to an external drive that keeps thirty days of versions.
3. 03An encrypted copy every week with a storage provider in Switzerland. Failing that, on a second drive kept outside the office and unplugged between copies.
4. 04A calendar reminder for the restore test.

And in our software

Qompta keeps your data on your computer, with no server. It writes an encrypted backup every time it starts and keeps it for seven days by default. That is the first copy. Another one still belongs off the computer, with the recovery key stored somewhere else: an encrypted backup cannot be read without it.