A backup drive that stays plugged in is just another folder for ransomware to encrypt. The 3-2-1 rule exists so that at least one copy of your data is always out of the attacker's reach.
Ask an office that survived ransomware how: almost always, the answer is a backup the attacker could not touch. Ask an office that paid the ransom why: their only backup was a USB drive permanently connected to the server - encrypted along with everything else. The 3-2-1 rule prevents exactly that: keep 3 copies of your data, on 2 different types of media, with 1 copy offsite or offline. This page turns the rule into a small-office routine, ending with the step everyone skips - the restore test.
Start with what you already have and add what is missing. Copy 1 is your live data. Copy 2 is an automatic nightly backup to a different device - a NAS or a dedicated backup drive on the server. Copy 3 is the survival copy: either cloud backup with versioning and immutability switched on, or physical drives that are plugged in only during the backup and then disconnected and stored away from the server.
Modern ransomware deliberately searches for backups. It deletes Windows shadow copies, browses network shares, and encrypts any drive it can reach - including that always-connected backup disk. It cannot encrypt a drive sitting in a drawer, and it cannot alter cloud storage that has immutable versions switched on, where even the account holder cannot modify backups for a set period. One of those two must exist in your setup. Without an unreachable copy, your backup layer is decoration.
The backup system is a target in its own right, so it gets its own defences. Use a separate admin password for the backup console - not the daily Windows password. Turn on MFA for cloud backup accounts. And restrict which PCs can even see the backup share; ordinary user accounts should have no delete rights over backups. Attackers who steal one staff password should gain nothing against the backup.
Here is the step that separates offices that recover from offices that discover, mid-crisis, that their backups were corrupt for six months. Once a month, actually restore something. Pick a handful of real files - last month's invoices, a database backup, a folder a staff member chooses at random - restore them to a test location, and open them.
If a test ever fails, fixing it that week is the highest-priority IT job in the office. You found the hole on a calm day instead of the worst day.
See the complete security setup live - firewall, endpoint, antivirus and backup, all in one video.
Watch Full VideoIt can be, if the cloud copy has version history and immutability or object-lock enabled, and you also keep a local copy for fast restores. Plain sync folders without protected versions do not qualify as the safe copy.
Two is the practical minimum - one connected for this week's backup, one disconnected and stored away. Three gives a deeper history if a problem is discovered late. Label them and keep a fixed rotation day.
Keep daily versions for at least a month and monthly versions for longer - slow corruption and quiet ransomware are sometimes discovered weeks later. Storage is cheap compared with losing the only clean copy.