Backup Guide for SMBs: The 3-2-1 Rule and Ransomware Protection

Many small businesses think about backups only when something goes wrong: the accounting PC's disk dies, an employee deletes the wrong folder, or staff arrive one morning to find every file renamed and a ransom note on screen. At that moment there is only one question: "Do we have a backup, and does it work?"

This guide is written for businesses without a large IT team. Our aim is to explain what to back up, how and where, in plain language, and to give you a checklist you can start using today.

What Is the 3-2-1 Rule?

3-2-1 is a simple but powerful rule that has guided backup practice for years:

• 3 copies: keep at least three copies of your data, one primary and two backups.
• 2 different media: store backups on at least two different types of media, for example a NAS device and cloud storage.
• 1 copy offsite: keep at least one copy outside the office, in a different location.

The logic: no single event (disk failure, fire, flood, theft, ransomware) should be able to destroy every copy at once. An office PC and the USB drive next to it can be lost together in the same fire, the same burglary or the same ransomware attack.

3-2-1-1-0: An Update for the Ransomware Era

Modern ransomware does not stop at encrypting files; it hunts for backups it can reach on the network and deletes or encrypts them too. Two more items have therefore been added to the rule:

• 1 copy immutable or offline: at least one backup sits on media that cannot be deleted for a set period (immutable) or is disconnected from the network.
• 0 errors: backups are verified regularly and restore tests complete without errors.

The last item is the one most often skipped, and the most important. An untested backup is one you believe exists but that may not open when you need it.

What Should You Back Up?

Employee Computers

People save files to the desktop, Downloads or Documents. When a laptop fails or is stolen, those files are gone. Desktop, Documents and working folders should be backed up automatically.

File Server or NAS

The server or NAS holding shared folders usually contains the company's most valuable data: quotes, contracts, projects, HR files. It needs both a local backup and a cloud copy.

Accounting and ERP Data

Accounting databases often sit on a single PC or small server and are among the most critical data you have. Even if you use the software's built-in backup feature, make sure those backup files are also copied elsewhere. File copies taken while the database is open can be corrupt; use the backup method the software recommends.

Email

Customer correspondence, quotes and approvals live in email. Find out how your email provider backs up data and for how long a deleted message can be recovered.

Microsoft 365

Many businesses on Microsoft 365 assume their data is backed up automatically. Microsoft is responsible for keeping the service running, but deleted items can be recovered only for a limited time, and long-term protection against accidental or malicious deletion is largely the customer's responsibility. Consider a separate backup solution for Exchange Online, OneDrive, SharePoint and Teams data.

Servers and Virtual Machines

If you run servers, backing up the whole machine (operating system, settings, applications) rather than just files lets you recover in minutes instead of hours after a failure.

Why Immutable Backups Matter

An immutable backup cannot be deleted or modified by anyone for a period you define after it is written. Even if an attacker steals your administrator password, they cannot delete it before that period ends.

In practice this is achieved by having your backup software write to cloud storage that supports object lock. Choose the retention period to suit your business: ransomware can sit unnoticed on a network for weeks, so plan for at least several weeks of protection rather than a few days.

Identity separation matters just as much. The account that accesses your cloud backups should not be the same administrator account used day to day, and should be protected with two-factor authentication wherever possible.

How Long Should You Keep Backups?

Retention matters as much as the backup itself. A backup that keeps only the last three days cannot rescue a folder deleted two weeks ago, or recover from an attack that has been quietly spreading for weeks. A practical starting point:

• Daily backups: keep at least 14 to 30 days. Most accidental deletions are noticed within that window.
• Weekly backups: keep for a few months, as an extra layer against late-discovered errors and attacks.
• Monthly backups: keep for a year or longer, depending on your legal and contractual retention needs.

Longer retention needs more storage, but because modern backup software stores only changed data, the increase is usually smaller than people expect. On the other hand, not keeping personal data longer than necessary is a core KVKK principle, so align retention periods with your data inventory. Writing the periods down in a short backup policy brings clarity to the team and makes it easy to show what you do during an audit.

Sync Is Not Backup

Sync tools such as OneDrive, Google Drive or Dropbox are very convenient, but they are not backups. When you delete a file or ransomware encrypts it, the change reaches the cloud copy within seconds. Version history and recycle bins offer some protection, but it is limited in time and scope. A real backup keeps independent, point-in-time copies stored separately.

Test Your Restores

The only purpose of a backup is to restore from it. Do not trust yours without regular testing:

• Monthly: restore a few random files and one folder and check that they open.
• Quarterly: restore the accounting database to a test PC and confirm the software opens it.
• Yearly: simulate losing a whole server and measure how long it takes to get it running again.

Keep short notes of test results. These records are also useful for demonstrating the technical measures you take for data security under KVKK.

A Simple Weekly Checklist

1. Check the backup software report to confirm all jobs from the past week succeeded.
2. Find and fix the cause of any failed jobs or warnings.
3. Confirm the cloud backup is current by checking the last backup date.
4. Check how full the local backup disk or NAS is.
5. If a new computer, server or important folder was added, make sure it is included in backups.
6. Disable accounts of departing employees, but consider retention needs before deleting their data from backups.
7. Run a small test by restoring a random file.

This takes no more than fifteen minutes a week and can prevent days of loss in a disaster.

Common Mistakes

• USB drive only: a USB drive permanently plugged into a computer is just another drive to ransomware. It also disappears with the computer in a theft or fire.
• Treating sync as backup: as explained above, deletions and encryption sync too.
• Never testing: backup jobs that have been failing for months are only discovered when you need them.
• Same password everywhere: if the backup system accepts the company admin account, an attacker can get in too.
• Forgetting critical data: accounting databases, email and Microsoft 365 data are often left out of backups.
• Short retention: keeping only the last few days is not enough for a deletion or attack that is noticed late.

CloudRUX SMB Packages

For businesses that would rather get backup, email and hosting in one bundle than set them up separately, here are our SMB packages:

Package	Includes	Monthly Price (VAT excluded)
Başlangıç (Starter)	Web hosting, 5 mailboxes, SSL certificate	9.90 USD
Ofis (Office)	Web hosting, 25 mailboxes, 250 GB PC and file backup	59 USD
Güvenli Ofis (Secure Office)	Office package, 1 TB immutable server backup, KVKK report, monthly check	From 129 USD

If you need a more flexible setup for server and virtual machine backup, see our CloudRUX BaaS (Backup as a Service) page.

Frequently Asked Questions

How long does a cloud backup take?

The first backup sends all of your data, so it can take a while depending on your internet speed. After that only changed data is sent, so backups are much faster and usually run automatically outside working hours.

If ransomware hits, will my cloud backup be affected?

Sync folders can be. But cloud backups stored as immutable and protected by separate credentials cannot be deleted or encrypted, even if an attacker gets into your network.

How often should I back up?

Ask yourself: "How many hours of data can we afford to lose?" For most small businesses a daily backup is enough; for fast-changing data such as accounting and order systems, several backups a day are safer.

Does it matter that backups are kept in Turkey?

Backups contain personal data about customers and employees. Backups held in Turkey avoid the extra processes that come with transfers abroad under KVKK, and restores are faster too.

Protect Your Backups with CloudRUX

With CloudRUX you can back up your computers, file server and servers to data centres in Turkey, with immutable copies. Find the right fit on our SMB packages and BaaS pages, or contact us to review your current backup setup together.