The 3-2-1 rule for SME backups

The 3-2-1 backup rule — three copies of the data, on two types of media, one of them off site — remains the anti-ransomware foundation for an SME on the Côte d'Azur. In Nice, Cannes, Monaco, or Tourrettes-sur-Loup, too many companies believe they are protected with a single local NAS. Host Technology, a PACA integrator, sets the policy, deploys it, and schedules restore tests: not a NAS delivered with no procedure.

Why three copies

Production plus local backup plus remote backup. If ransomware encrypts the office NAS, the remote (or immutable) copy remains. Two copies on the same site fall together in a fire, a theft, or lateral encryption. The third copy off site is not a luxury; it is the minimum for continuity.

On the Côte d'Azur, fire, water damage in the technical room, and ransomware sit side by side in field experience. The third off-site copy answers all three scenarios, not only encryption.

Two media types, one logic

Local disk / NAS plus object cloud, or tape, or a dedicated appliance. The idea is not to depend on a single technology or a single controller. Host chooses according to volume, fiber bandwidth, and budget — shared FTTH versus FTTO changes the overnight backup window.

The choice of the second medium also takes cybersecurity into account: an SMB share open for write to “every workstation” is not a backup. Host Technology isolates the repositories and the backup accounts.

Off site and immutability

A copy that the domain admin cannot delete on Friday evening. Versions, a vault, Object Lock / retention lock depending on the tool. Against ransomware, immutability turns a backup “that exists” into a backup “that survives.” Host Technology builds it into PACA SME backup projects.

Test the restore from the immutable copy, not only from the local NAS: that is the copy that will be used on the day. Time it and note the network prerequisites (VPN, credentials, tools).

RPO and RTO: speak in business terms

RPO: the maximum acceptable data loss (last successful backup). RTO: how quickly the service must return. Phone reception, accounting, and the patient record do not share the same figures. Realistic objectives are set, then frequency and infrastructure are sized. The disaster-recovery and business-continuity plan starts here.

Telephony belongs in the disaster-recovery plan: without restorable IPBX configs, the voice RTO lengthens even if the business files are back. Host backs up configs and the numbering plan with the rest.

3-2-1 backup checklist (SME)

1. Map critical data (files, servers, Microsoft 365, IPBX/firewall configs).
2. Define RPO/RTO per business application.
3. Put in place a local copy plus a remote copy (or an immutable one).
4. Separate backup accounts from day-to-day admin accounts (MFA).
5. Encrypt flows and off-site repositories.
6. Schedule a restore test of a business folder every quarter.
7. Monitor jobs (alert on failure) through managed IT.
8. Document the recovery procedure so a third party can run it.

Also tick the box “who has the rights to unlock / restore outside immutability”: a two-person procedure limits abuse and mistakes. Host managed IT can carry that role.

Microsoft 365 and SaaS: do not forget them

The native recycle bin does not replace a third-party backup for Exchange Online / OneDrive / SharePoint. Mass deletions and some cloud ransomware make the point. Host includes email in the scope when it is critical to the business.

Microsoft 365 retention policies (litigation hold, and so on) do not replace a dedicated backup for every scenario. Host clarifies the boundary during the audit.

Network and telephony configs

Firewall, switches, IPBX, numbering plan: without a config backup, a bad change or failed equipment stretches the RTO by days. The 3-2-1 backup also applies to configurations. Host versions them with the rest of the IT system.

A poorly versioned firewall config restore can cut VoIP: it is tested in a controlled window, with 4G backup ready. The 3-2-1 backup also serves telecom continuity.

Testing: the only proof

Restore a business folder, time it, note the recovery point. A backup that has never been restored does not exist. Quarterly tests are part of the Pro/Full managed-IT contract; they avoid discovering a corrupted repository on the day of the incident.

Keep dated test reports: insurers and contracting clients ask for them more and more. Host Technology archives them with the client file.

What Host delivers

A written policy, tool deployment, immutability if selected, job monitoring, a test calendar, and a link with the telephony/data disaster-recovery plan. No black box: you know where the copies are and how to recall them.

The final deliverable ties backup, monitoring, and the disaster-recovery plan together: who is alerted, who restores, in how long. That is the core of the PACA integrator offer.

• An inventory of sources, volumes, owners, dependencies, and data sensitivity levels.
• A matrix of frequencies, retention periods, locations, encryption, and RPO and RTO objectives.
• Restore procedures by service, with prerequisites, emergency accounts, and the order of restart.
• Monitoring reports and dated test minutes, kept with the disaster-recovery plan.

In practical terms, every PACA site has its own constraints (building, seasonality, multi-site setups across Monaco and Nice): Host Technology adapts the action plan rather than copying a fixed national template, with a single point of contact for the network, telephony, backup, and managed IT.

A serious policy also covers the lifecycle. When an application disappears, its archives must stay accessible for the required period without paying indefinitely for oversized infrastructure. When a volume grows, the window and the storage must follow before saturation. Host Technology reviews these parameters with the SME and ties the decisions to the contractual, accounting, or regulatory obligations that actually apply.

• Each day, check execution, the amount of data protected, and duration anomalies.
• Each month, check remaining capacity, growth, new sources, and authorized accounts.
• Each quarter, restore a business sample chosen with a user, then measure the time taken.
• Each year, simulate a wider scenario involving the network, servers, telephony, and crisis communication.

Tests must represent several incidents: accidental deletion, an encrypted workstation, an unavailable server, and loss of the main site. Restoring a file does not prove that the full application will restart. Dependency order, licenses, DNS, the firewall, and accounts are sometimes essential. The integrator documents these prerequisites so a team can resume operations even if the usual person is absent.

For organizations in Nice, Cannes, Monaco, and Tourrettes-sur-Loup, the remote copy must also take connectivity into account. A large volume on a low upload rate requires a controlled first seed or an incremental strategy. Host Technology coordinates fiber, storage, encryption, and monitoring so the 3-2-1 backup stays compatible with production hours and the SME’s costs.

FAQ

Does the 3-2-1 rule fully protect against ransomware?

It sharply reduces the risk of permanent loss, especially when the remote copy is immutable and isolated. It does not, however, replace prevention, segmentation, MFA, and detection. An attacker can also steal the data before encrypting it. The strategy must therefore combine cybersecurity and recovery. Host Technology checks that backup accounts do not depend entirely on the compromised domain and that the restore has actually been tested.

What backup frequency should an SME choose?

Frequency follows acceptable loss. Active accounting may need several points a day, while a stable archive can be protected daily or less often. Network capacity and processing time must also be considered. Host Technology defines an RPO per service with the business owners, then configures the jobs accordingly. Applying the same frequency everywhere often raises cost without protecting priority activities any better.

Is a cloud backup enough to meet the 3-2-1 rule?

Not automatically. You must check where production sits, how many independent copies exist, which accounts can delete them, and whether the provider offers immutable retention. A cloud sync can immediately reproduce a deletion or encryption. Qualification examines the technical and administrative independence of the copies. Host Technology documents the medium, the region, encryption, retention, and the recovery procedure before considering the rule satisfied.

How long should backups be kept?

The duration depends on business needs, contracts, applicable obligations, and how long an incident may go unnoticed. Short retention restores recent errors, while monthly or yearly points answer other scenarios. Keeping everything indefinitely raises cost and data exposure. The company defines a matrix by category, then reviews it. The integrator makes sure the real configuration matches the approved policy.

How often should a restore be tested?

A quarterly test is a practical baseline for important data, completed by a wider annual exercise. Highly critical services may need more frequent or automated checks. Each test must be dated, timed, and validated by a user able to open the restored data. Host Technology keeps the report, corrects the gaps, and updates the recovery plan so progress is measurable.

Does your backup really meet the 3-2-1 rule? Contact Host Technology for an on-site backup audit on the Côte d'Azur or in Monaco — copies, immutability, restore test, and monitoring.