Ask most business owners whether their data is backed up and the answer is “I think so”. Ask when they last restored a file from that backup and the room goes quiet. In an environment where power surges damage hardware, laptops get stolen in traffic and ransomware targets businesses of every size, a reliable backup is not an IT luxury. It is insurance. The 3-2-1 backup rule is the simplest proven way to get it right.
What is the 3-2-1 backup rule?
The rule is easy to remember:
- 3 copies of your important data: the original plus two backups.
- 2 different types of storage, so a single failure cannot destroy everything (for example, an external drive and a cloud service).
- 1 copy kept off-site, away from your office, so fire, flood or theft at one location does not wipe you out.
Many security professionals now add one more element: keep at least one copy that is offline or immutable, meaning it cannot be changed or deleted, even by someone with your passwords. That is your last line of defence against ransomware.
Why Nigerian businesses are especially exposed
- Power instability: sudden outages and surges can corrupt files or destroy drives, particularly when equipment is not on a UPS.
- Device theft and loss: laptops and phones carry business data out of the office every day.
- Ransomware and phishing: attackers encrypt your files and demand payment. Paying does not guarantee recovery.
- Single-device storage: many small businesses keep everything on one computer or one staff member’s phone.
- WhatsApp-only records: orders, receipts and agreements that live only in chat history are easily lost.
Step 1: Decide what needs protecting
List the data your business cannot operate without:
- Accounting records and invoices.
- Customer and supplier databases.
- Contracts, HR files and payroll records.
- Your website and its database.
- Design files, product photos and marketing assets.
- Email and important WhatsApp Business chats (exported regularly).
Rank them by how painful it would be to lose a day, a week or a month of each. That tells you how often to back them up.
Step 2: Choose your three copies
A practical setup for a small or medium business might look like this:
- Primary copy: your working files in a cloud workspace or on office computers.
- Local backup: an external drive or small network storage device in the office, updated automatically every day.
- Off-site backup: a reputable cloud backup service that keeps version history, so you can restore files from before a problem started.
For your website, use a backup plugin or your host’s backup service, and make sure copies are stored somewhere other than the same server.
Step 3: Automate it
Manual backups fail because people forget, travel or get busy. Schedule backups to run automatically, ideally outside working hours, and set up alerts so someone is notified when a backup fails.
Step 4: Protect the backups themselves
A backup that ransomware can reach is not a backup. Protect yours by:
- Using separate login details for your backup service, with multi-factor authentication.
- Turning on version history or immutability features where available.
- Disconnecting external drives when the backup is complete, or rotating two drives so one is always offline.
- Encrypting backups that contain customer data, as part of your obligations under the Nigeria Data Protection Act. Our NDPA checklist covers this in more detail.
Step 5: Test your restore
This is the step almost everyone skips. At least once a quarter:
- Restore a random file and check it opens correctly.
- Restore a full folder or database to a test location.
- Time how long a full recovery would take.
If you cannot restore it, you do not really have it.
Step 6: Keep the power clean
Backups protect your data; good power protects your equipment. Put servers, network storage and key computers on a UPS, use surge protection and make sure systems shut down safely when inverter or generator power fails.
A simple backup checklist
- Important data identified and ranked.
- Three copies on two types of storage, one off-site.
- At least one offline or immutable copy.
- Backups automated with failure alerts.
- Backup accounts protected with MFA.
- Restores tested every quarter.
- Critical equipment on UPS and surge protection.
When to get help
If your business relies on servers, line-of-business software or large amounts of customer data, consider managed backup and monitoring. Geopaju’s cloud and managed services team designs, runs and monitors backup and recovery for businesses, so problems are caught before they become disasters. Talk to us about a backup health check.
