The 3-2-1 backup rule is the single most durable idea in data protection: keep 3 copies of your data, on 2 different types of media, with 1 copy held offsite. It predates the cloud, it predates ransomware, and in 2026 it remains the foundation on which every serious UK cloud backup strategy is still built — because the arithmetic of survivability has not changed even as the threats have.
This guide explains the rule in plain terms, then shows how UK businesses extend it into a genuinely ransomware-proof posture: why immutable offsite copies defeat attackers who now target backups first, how to write a retention policy that satisfies both HMRC and GDPR, how to test restores so you discover problems on a Tuesday morning rather than during a live incident, and how to choose between cloud-only and hybrid architectures. You will finish with a practical audit checklist and a cost-and-risk frame you can take to the board.
What the 3-2-1 backup rule actually means
The rule is a mnemonic, not a product. It says that at any given moment your important data should exist as three distinct copies. Two of those copies should live on different classes of storage — so a fault, firmware bug or corruption event that affects one class cannot silently take out both. And at least one copy should sit somewhere physically and logically separate from your primary site, so that a fire, flood, theft or site-wide compromise cannot reach every copy at once.
Worked through concretely for a typical UK office: copy one is your live data on the file server or in Microsoft 365. Copy two is a local backup appliance or NAS that gives you fast, same-day restores. Copy three is a cloud backup repository in a separate region, reached over the internet and governed by different credentials. Three copies, two media types (local disk and cloud object storage), one offsite (the cloud region). That is the rule, satisfied.
What the rule quietly forces on you is independence. The value is not in the number three for its own sake — it is that each copy fails for different reasons. A single copy that is replicated ten times is still one copy if all ten share the same account, the same ransomware blast radius, or the same accidental “delete everything” command. Independence is the property that turns storage into insurance.
Sync is not backup. A folder that mirrors instantly to the cloud will faithfully mirror an encryption event or a mass deletion just as fast. Real backup keeps historical, point-in-time versions you can roll back to — treat “it is in OneDrive” as replication, not protection, and layer versioned backup on top.
Where most UK businesses actually sit on backup maturity
Before prescribing a target state, it helps to be honest about the starting line. Across the SMEs we assess, the same weak spots recur: backups exist but are never tested, the offsite copy shares credentials with production, and Microsoft 365 is assumed to be “backed up by Microsoft” when it is not. The grid below scores the areas that most often decide whether a business survives a ransomware event or spends three weeks rebuilding from scratch.
The pattern is consistent: businesses invest in making backups and neglect proving they can restore from them. A green tick in a backup console tells you a job completed — it does not tell you the data is readable, complete, and free of the ransomware that may already have been dwelling on the network when the backup ran.
The 3-2-1 backup rule by the numbers — UK 2026 reality check
The threat landscape is why the rule has been extended rather than retired. Modern ransomware is a business, and its operators have learned that the fastest route to a paid ransom is to destroy the victim’s ability to recover independently. The bars below show where the pressure now falls — each figure reflects the direction of travel reported across NCSC guidance, DSIT breach data and incident-response practice, and should be read as indicative rather than precise.
Read together, these numbers make a single point. Paying a ransom is not a recovery strategy — nearly half of paying victims never get all their data back, and payment may itself raise questions under sanctions rules the NCSC and ICO have both flagged. An independent, immutable, tested offsite copy is the only asset that reliably ends the incident on your terms.
Cloud backup cost breakdown for UK SMEs
Backup pricing is driven by the volume of data you protect, how long you retain it, and how fast you need to recover. The table below gives realistic monthly ranges for UK small and mid-sized businesses in 2026. Figures are indicative ex-VAT guide prices to frame budgeting conversations, not quotes — your data profile will move the numbers.
| Backup tier | Typical scope | Protected data | Indicative monthly cost |
|---|---|---|---|
| Microsoft 365 backup only | Exchange, SharePoint, OneDrive, Teams per user | 10–50 users | £30–£180 |
| Cloud-only server backup | Files, databases, VMs to cloud object storage | 0.5–2 TB | £90–£350 |
| Hybrid (local appliance + cloud) | Fast local restore plus immutable offsite copy | 1–5 TB | £250–£850 |
| Managed backup + DR | Monitored jobs, tested restores, standby recovery | 2–10 TB | £600–£2,200 |
| Immutable long-term archive | WORM object storage for 7–10 year retention | Per TB per month | £6–£22 / TB |
The number that matters is not the monthly fee — it is the ratio of that fee to the cost of the outage it prevents. A mid-sized firm losing access to its systems for a working week can burn far more in lost billing, overtime rebuild effort and reputational damage than a year of managed backup. Frame backup as risk transfer, and the spend becomes a proportion of exposure rather than a line item to trim. For teams weighing where cloud spend goes more broadly, our Azure VM sizing guide for UK SMEs covers the compute side of the same budget conversation.
The 3-2-1 rollout timeline — what a real implementation looks like
A sound backup programme is not a purchase, it is a sequence. The timeline below is the path we most often walk with a UK SME moving from “we have some backups” to a tested, ransomware-resilient 3-2-1 posture. Most organisations reach a defensible state within six to eight weeks without disrupting day-to-day work.
Cloud-only versus hybrid backup architecture
The most common architecture decision is whether to keep a local backup at all. Cloud-only is simpler and cheaper to run; hybrid adds a local copy that restores far faster for large datasets. Neither is universally right — it depends on your recovery-time target and how much data you would need to pull back over the internet during an incident.
Cloud-only backup
Everything to the cloud, no local appliance
Hybrid backup
Local appliance plus immutable cloud copy
For most UK SMEs with on-premise servers or virtual machines, hybrid wins because it satisfies the whole rule elegantly: local disk and cloud object storage are your two media types, the cloud region is your offsite, and immutability protects the copy that matters most. A cloud-only model is an excellent fit where the workload is already SaaS — if your data lives in Microsoft 365, pair backup with the discipline in our Microsoft 365 email migration checklist so the tenant you are protecting is cleanly configured in the first place.
Backup readiness gauge — scoring your current posture
Before you invest, benchmark honestly. The gauge below reflects the average 3-2-1 readiness score we see when first assessing a UK SME that believes it is “covered”. The gap between that starting score and a defensible 85-plus is almost entirely made up of the untested, un-isolated and un-immutable elements the rest of this guide addresses.
A score in the mid-fifties is typical and not a cause for panic — it usually means the fundamentals exist but the ransomware-specific protections do not. The quickest points to reclaim are immutability on the offsite copy, credential isolation for the backup plane, and a single documented, timed restore test. Those three alone routinely move a business from “hopeful” to “resilient”.
Backup and recovery benchmarks and KPIs
What gets measured gets restored. A mature backup programme reports on a small set of numbers every month so that drift is caught early rather than during an incident. The benchmarks below are the maturity targets we hold UK SME estates against — the aim is steady progress toward the right-hand edge, not perfection on day one.
Average UK SME backup maturity scores
The three lowest bars — immutable offsite copy, recent restore test, and documented runbook — are precisely the ones that decide the outcome of a ransomware event. They are also the cheapest to fix, because they are matters of configuration and discipline rather than large capital spend.
Immutability and offsite protection — the numbers behind resilience
The reason immutability has become central is simple: attackers now come for the backups. An immutable copy uses write-once-read-many (WORM) object locks so that, once written, data cannot be altered or deleted until the retention period expires — not by an administrator, not by ransomware, not by a stolen credential. The share of successful recoveries that trace back to an immutable, isolated offsite copy keeps climbing, which is exactly why it sits at the heart of a modern 3-2-1 design.
The counterpart figure is just as instructive: where the only offsite copy shared credentials or network reach with production, attackers frequently reached and destroyed it before deploying their ransomware payload. Immutability plus isolation is what converts “we have an offsite backup” into “we have an offsite backup they could not touch”. That distinction is the whole game.
Real-world example — a Leeds professional-services firm
A 42-person accountancy practice in Leeds ran nightly backups to a NAS in the same server cupboard as production, plus a cloud sync of its shared drive. On a Thursday, a ransomware payload delivered through a compromised supplier email encrypted the file server, reached the NAS across the flat network, and corrupted the synced cloud folder within minutes because sync faithfully propagated the encryption. Two of their three “copies” were gone before anyone logged a ticket.
What saved them was a change made only weeks earlier: a managed hybrid backup with an immutable cloud tier on separate credentials. Because that copy could not be altered or deleted, the practice restored its file server and databases to a clean environment, verified integrity with checksums, and was operational again inside a working day — without paying the ransom or reporting a loss of client data to the ICO.
We genuinely believed three backups meant we were safe. We learned the hard way that they have to fail for different reasons — the immutable offsite copy was the only one the attacker could not reach, and it was the only one that mattered.
The lesson generalises. The firm had the quantity of copies the rule asks for, but not the independence that makes the rule work. Once the offsite copy was made immutable and credential-isolated, the same three copies became genuinely ransomware-resilient.
Common cloud backup mistakes to avoid
Most backup failures are not exotic. They are the same handful of avoidable errors, repeated across thousands of UK businesses. Recognising them is half the fix.
- Treating sync as backup. OneDrive, Dropbox and Google Drive replicate the current state, including an encryption event. Without versioned, point-in-time backup you cannot roll back.
- Leaving the offsite copy reachable. If a compromised domain-admin account can delete your cloud backup, it is not offsite in any meaningful sense — it is just remote.
- Never testing a restore. A backup you have not restored is a hypothesis. The first full restore attempt during a live incident is the worst possible time to discover a fault.
- Assuming Microsoft 365 backs itself up. Microsoft protects the platform, not your data against deletion, retention gaps or ransomware. The shared-responsibility model puts your data on you.
- Retention that is too short. Dwell-time means ransomware may sit undetected for weeks. If your oldest backup is 14 days old, every clean copy may already be encrypted or infected.
- One media type only. Two copies on the same NAS, or two cloud copies in the same account, fail together. Independence across media and accounts is the point.
- No monitoring. Silent backup failures accumulate. If nobody is alerted when a job fails, you discover the gap only when you need the data that never made it.
- Backing up the ransomware. Without integrity checks and anomaly detection, you can dutifully back up already-encrypted or infected files and overwrite your last clean copy.
The single most dangerous assumption is “the backup ran, so we are covered.” A completed job proves data was written, not that it can be read back, is complete, or is free of dormant malware. Only a tested, verified restore proves recoverability — everything else is optimism. Security-conscious teams should read this alongside our Cyber Essentials vs Plus guide, since backup and certification reinforce each other.
The 3-2-1 backup audit checklist — the 12-point essentials
Use this checklist to audit your current position or to brief a provider. Work top to bottom; each item is a control that a ransomware-proof 3-2-1 strategy should be able to demonstrate, not merely claim.
- Confirm three independent copies of every critical dataset exist right now — production plus two backups.
- Verify the two backups sit on different media or storage classes (for example local disk and cloud object storage).
- Confirm at least one copy is genuinely offsite — a separate region, reached over separate credentials.
- Enable immutability (WORM / object lock) on the offsite copy for the full retention window.
- Isolate the backup control plane: separate identities, MFA everywhere, no domain-admin reach into the backup store.
- Include Microsoft 365 and every business-critical SaaS platform in scope, not just on-premise servers.
- Set and document RPO and RTO per system, agreed with the business, and design to meet them.
- Extend retention to satisfy both ransomware dwell-time and legal obligations (HMRC records, GDPR, sector rules).
- Configure alerting so any job failure is flagged to a named owner within one hour.
- Perform a full restore test at least quarterly, timed and checksum-verified, into an isolated environment.
- Maintain a written recovery runbook that a competent engineer could follow under incident pressure.
- Review the whole policy annually and after any material change in data volume, systems or premises.
If you can tick every box above, you have moved well beyond “we have backups” to a demonstrable, defensible recovery capability — the kind that stands up to a board question, an insurer’s due diligence, and a real ransomware event. Uptime for the recovery link itself matters too; our leased line vs broadband guide covers the connectivity that large restores depend on.
At-a-glance summary
| Question | Short answer |
|---|---|
| What is the 3-2-1 rule? | 3 copies, 2 media types, 1 offsite copy of your data. |
| Why does it still matter in 2026? | The maths of independent survivability is unchanged; only the threats evolved. |
| What beats modern ransomware? | An immutable, credential-isolated offsite copy attackers cannot delete. |
| Is sync the same as backup? | No — sync replicates deletions and encryption; backup keeps versions. |
| Is Microsoft 365 backed up already? | No — shared responsibility puts your data protection on you. |
| Cloud-only or hybrid? | Cloud-only for SaaS/small sets; hybrid for servers and tight RTOs. |
| How long should I retain backups? | Long enough for ransomware dwell-time plus legal record obligations. |
| What is immutability? | WORM object locks that prevent change or deletion until retention ends. |
| What is RPO? | How much data you can afford to lose, measured in time. |
| What is RTO? | How long you can afford to be down before recovery completes. |
| How often should I test restores? | At least quarterly, timed and checksum-verified. |
| Typical SME monthly cost? | Roughly £30–£2,200 depending on scope and DR. |
| Biggest single mistake? | Assuming a completed backup job means the data can be restored. |
| First priority if budget is tight? | Make the offsite copy immutable and run one tested restore. |
Build a ransomware-proof 3-2-1 backup strategy
Cloudswitched designs, deploys and manages cloud and hybrid backup for UK businesses — immutable offsite copies, isolated backup planes, and tested restores you can rely on.
Talk to a Cloud Backup SpecialistFrequently Asked Questions
What is the 3-2-1 backup rule in simple terms?
The 3-2-1 backup rule says you should keep three copies of your important data, store them on two different types of media, and keep one copy offsite. The goal is independence: each copy fails for different reasons, so no single event — hardware fault, accidental deletion, fire or ransomware — can destroy every copy at once. It is a design principle rather than a product, and it underpins virtually every credible cloud backup strategy in use today.
Does the 3-2-1 rule protect against ransomware?
The classic rule needs one modern extension to defeat ransomware: the offsite copy must be immutable and credential-isolated. Attackers now hunt for backups first, so a remote copy that a compromised administrator account can delete offers little protection. Add write-once-read-many object locks and a separate identity plane, and the offsite copy becomes something the attacker cannot alter or erase — which is what reliably ends the incident without paying a ransom.
Is cloud sync the same as cloud backup?
No, and conflating the two is a common and costly mistake. Sync tools such as OneDrive, SharePoint, Dropbox and Google Drive mirror the current state of your files in near real time. If a file is encrypted by ransomware or deleted, that change is faithfully mirrored everywhere. True backup keeps historical, point-in-time versions you can roll back to, so you can recover the state of your data as it was before the damage occurred.
Do I need to back up Microsoft 365 separately?
Yes. Microsoft operates under a shared-responsibility model: it keeps the platform available and resilient, but protecting your data against deletion, retention gaps, malicious insiders and ransomware is your responsibility. Native retention and recycle bins are limited and time-bound. A dedicated third-party backup of Exchange, SharePoint, OneDrive and Teams gives you the long retention and point-in-time recovery that the platform alone does not.
How long should a UK business keep its backups?
Two forces set the answer. First, ransomware dwell-time means an attacker may be present for weeks before triggering, so backups must reach far enough back to find a clean copy. Second, legal and regulatory obligations — HMRC record-keeping, GDPR, and any sector rules — set minimum retention for certain records. A common pattern is short-interval backups kept for weeks, plus longer-term immutable archives held for the years your compliance obligations require.
What is the difference between RPO and RTO?
Recovery Point Objective (RPO) is how much data you can afford to lose, expressed in time — if you back up every hour, your RPO is roughly one hour. Recovery Time Objective (RTO) is how long you can afford to be down before systems are restored. Setting realistic RPO and RTO figures for each system, agreed with the business, is what drives sensible architecture and cost decisions rather than guesswork.
Should I choose cloud-only or hybrid backup?
Cloud-only backup is simpler and cheaper and is an excellent fit for SaaS data and smaller file sets, but recovering large volumes is bounded by your internet bandwidth. Hybrid backup adds a local appliance so large restores complete in minutes from local disk, while an immutable cloud copy provides the offsite protection. For businesses running on-premise servers, databases or virtual machines with tight recovery-time targets, hybrid is usually the stronger fit.
What does immutable backup actually mean?
Immutable backup uses write-once-read-many (WORM) storage or object-lock features so that, once data is written, it cannot be modified or deleted until a defined retention period expires. Crucially, this applies even to administrators and to anyone wielding stolen credentials. Immutability is the control that stops ransomware operators from deleting your last clean copy, which is why it has become central to ransomware-resilient backup design.
How often should we test our backups?
At least quarterly, and after any significant change to systems or data. A test should restore representative data into an isolated environment, verify integrity with checksums rather than a console tick, and be timed so you know your real recovery speed. Roughly one in five UK businesses discovers a backup will not restore only when they first try during a live outage — scheduled drills move that discovery to a controlled setting.
How much does cloud backup cost for a UK SME?
As a guide, Microsoft 365 backup often runs from tens of pounds a month, cloud-only server backup from around £90 to £350, and managed hybrid backup with disaster recovery from several hundred to a couple of thousand pounds monthly, depending on data volume and recovery requirements. The figure that matters most is the ratio of that cost to the cost of the outage it prevents — backup is best framed as risk transfer.
Can I just pay the ransom if we are hit?
Paying is unreliable and risky. A significant share of organisations that pay never fully recover their data, and payment may raise legal and sanctions questions that the NCSC and ICO have both highlighted. It also marks you as a paying target. A tested, immutable, offsite backup lets you refuse the demand and recover on your own terms, which is both cheaper and safer over time.
Does having backups help with Cyber Essentials?
Backup is not a scored control in the core Cyber Essentials questionnaire, but a sound backup and recovery capability strongly supports the resilience the scheme is designed to encourage, and it is often expected by cyber-insurers and larger clients during due diligence. Treat certification and backup as complementary: one reduces the chance of compromise, the other guarantees you can recover when prevention is not enough.
Related reading
Make your offsite copy the one they cannot touch
From immutable cloud repositories to fully managed hybrid backup and tested disaster recovery, Cloudswitched helps UK businesses turn three copies into genuine resilience.
Talk to a Cloud Backup Specialist
CloudSwitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
