When a ransomware note lands on your server at 3 AM, the first question is not “how do I fix this?” It is “where is my last clean copy of the data?” If you cannot answer in seconds, you do not have backups. You have a backup plan, which are very different things.

The rule in one line

  • 3 copies of your data (1 live, 2 backup)
  • 2 different media types (e.g., local disk + cloud object storage)
  • 1 copy off-site (a region or vendor that is not affected by the event that killed the primary)

Every one of those three numbers earns its place. Drop “off-site” and a fire in your office erases everything. Drop “two media types” and a single firmware bug takes all three copies at once.

What it looks like for an SMB

  1. Live system — the machines your staff use every day, with automatic disk snapshots where supported.
  2. Local copy — encrypted nightly snapshots to a NAS or secondary volume, kept within reach so restores are measured in minutes.
  3. Cloud copy — immutable (write-once) backups to an object store in a different region. Immutable is the keyword: ransomware that gains your credentials cannot delete or overwrite what it should not be able to touch.

If you only do one of the three, you will survive a bad day. If you skip any tier, a bad month ends your business.

The test that separates real from fake

Run a restore drill once a quarter and time it. Not “we trust this system.” A timed restore on a non-production machine, with a named owner and a measured RTO (recovery time objective). If last quarter’s drill took 6 hours, you now know your real exposure — and your board knows your SLA, not your marketing.

Common mistakes we see in audits

  • Backups going to the same VLAN as production — one compromised switch, zero recovery.
  • “Cloud backup” that is actually a sync folder anyone can delete.
  • No verification step: the job logs success but nobody has ever restored from it.
  • RPO (how much data you can afford to lose) is never written down anywhere.

If your current answer to “when did we last restore?” is “we don’t restore, we just trust it,” that is the number one finding in your next audit. We document this in every MSPE infrastructure audit for a reason: backup is not a product, it is a practiced habit with measured recovery times. Our hosting & cloud service in Lebanon sets up exactly these 3-2-1 tiers with immutable off-site copies, and the IT support and helpdesk team in Baabda, Lebanon runs the restore drills that prove they work.