Small business backups: the 3-2-1 rule, what Microsoft 365 and Google do not keep, and testing a restore
Keep three copies of important data on two kinds of storage with one off-site, as CISA recommends, and keep at least one copy offline or unchangeable so ransomware cannot reach it. Cloud apps like Microsoft 365 and Google Workspace keep deleted items only for weeks, so they are not a backup on their own. A backup you have never restored is a guess.
By the editors of ProtectYour.com Last reviewed 5 min read
Key takeaways
- CISA's 3-2-1 rule: three copies of important files, on two types of storage, with one copy off-site.
- Keep one copy offline, encrypted or immutable. Ransomware looks for backups it can reach and destroys them first.
- Microsoft 365 and Google Workspace keep deleted items for limited periods, measured in days or weeks, not years.
- Test a restore at least once a year, and CISA suggests making sure you can roll data back at least seven days.
- Start with an inventory: the accounting file, customer records, payroll, email and the shared drive.
The 3-2-1 rule, in plain terms
CISA's guidance for small businesses calls 3-2-1 a trusted guideline (CISA):
- 3 copies of important files: the live data plus two backups.
- 2 different types of storage, such as an external drive and a cloud service.
- 1 copy off-site, away from your business location, so a fire, flood or theft does not take everything.
CISA also says to protect backups with physical security, encryption and offline copies, to use an automated backup rather than relying on someone remembering, and to make sure critical files can be reached without an internet connection.
Sync is not backup
What Microsoft 365 and Google Workspace keep, and for how long
Many small firms assume their email and files are backed up because they are in the cloud. The provider keeps the service running; it does not promise to give you back what you or an attacker deleted months ago.
Built-in recovery windows, from the providers' own documentation
| Service | What happens to deleted items | Source |
|---|---|---|
| SharePoint and OneDrive | Recycle bins keep items 93 days from deletion, then they are gone | Microsoft |
| Exchange Online (Outlook) | Permanently deleted mail is recoverable for 14 days by default, up to 30 if an admin changes it | Microsoft |
| Google Drive (Workspace) | An admin can restore files within 25 days after a user empties their trash | |
| Google Vault | Google says Vault is for retention and eDiscovery and is not designed to be a backup tool |
Both providers offer more. Microsoft sells Microsoft 365 Backup as a pay-as-you-go add-on for SharePoint, OneDrive and Exchange, and Google points Workspace customers to partner backup tools and its data export. Independent backup services for both platforms exist too. Pick one that keeps copies outside your main admin account, so a compromised admin cannot delete them.
Step 1: list what you cannot run without
CISA suggests starting with an inventory. For most small businesses it is a short list:
- The accounting file or the export from your cloud accounting app.
- Customer and job records, quotes and contracts.
- Payroll and HR records you are required to keep.
- Email, if it holds the only record of agreements.
- The shared drive, website files and any database behind your booking or ordering system.
- Configuration you would hate to rebuild: the website, the domain and DNS settings, the point-of-sale setup.
Write down where each one lives and how it is backed up. A spreadsheet is fine.
Step 2: a setup that meets 3-2-1
A common, inexpensive pattern for a small office:
- Copy one: the live data in Microsoft 365, Google Workspace or on the office computers.
- Copy two: an automatic cloud backup service that keeps versions for months, with its own login protected by multi-factor authentication and not tied to the same admin account.
- Copy three: an encrypted external drive or a network storage device, updated on a schedule and disconnected afterward, with one drive kept off-site (rotated home or to a second location).
For laptops, turn on the built-in options too: File History or a backup tool on Windows, Time Machine on a Mac. And turn on disk encryption (BitLocker or FileVault) so a stolen backup drive or laptop is not a breach.
Step 3: prove it works
CISA says to test that you can restore data both fully and partially, to make sure you can roll back at least seven days, and to document the recovery steps and train staff to use them. Its ransomware guide recommends testing backups regularly, because ransomware often deletes or encrypts any backup it can reach (CISA #StopRansomware Guide).
- Once a quarter, restore one file and one mailbox item from the backup, not the recycle bin.
- Once a year, restore something larger, like the accounting file to a spare computer, and time it.
- Write down the steps, who can do them and where the backup passwords are kept.
Free step
Backups are the control that turns ransomware from a business-ending event into a bad week. See ransomware for small businesses for the rest of the plan, and the security checklist for where backups fit.
Common questions
What is the 3-2-1 backup rule?
CISA describes it as three copies of important files, on two different types of storage such as a hard drive and the cloud, with one copy stored off-site away from your business.
Does Microsoft 365 back up my data?
Not in the sense of long-term backup. SharePoint and OneDrive recycle bins keep deleted items 93 days, and Exchange Online keeps permanently deleted mail 14 days by default (up to 30). Microsoft sells Microsoft 365 Backup as a separate pay-as-you-go service.
Is Google Vault a backup?
No. Google's own Vault FAQ says Vault is not designed to be a backup or archive tool. It is for retention and eDiscovery. Google points customers to data export and partner backup tools.
How often should a small business test its backups?
CISA guidance says to test backups and recovery on a recurring basis, no less than once a year, and to confirm you can restore data both fully and partially and roll back at least seven days.
Your next step
Related guides
- Ransomware and small businesses: how to prevent it, and what to do in the first hoursRansomware usually gets in through a phishing email, a stolen password or an unpatched internet-facing system. Offline backups, phishing-resistant multi-factor sign-in and prompt updates stop most of it. If it hits, isolate the affected machines, do not wipe anything, and report it to the FBI and CISA before deciding anything about payment.
- Small business cybersecurity checklist: the 10 controls that matter mostTen controls, in the order we would do them, for a business without an IT department. Most are free and take an afternoon.
- Best antivirus and endpoint protection for small business: antivirus vs EDR vs MDRWhat the jargon means, which products suit a team of 1 to 50 people, and the setup details that decide whether any of them works.
- Choosing a password manager for a small business, and the offboarding rule that matters mostAny of the three business password managers most small firms consider (1Password, Bitwarden, Proton Pass) is a large step up from a shared spreadsheet or a browser's saved passwords. Pick on the admin features you need, then set up shared vaults and an offboarding routine on day one.