The 3-2-1 rule says: keep 3 copies of your important information (the original and 2 backups), on 2 different types of storage, with 1 of them outside your company. Today it makes sense to add two things: that one copy be disconnected or impossible to delete, because ransomware tries to destroy backups, and that you actually test that you can restore. A backup that has never been tested is an assumption, not a backup.
What is the 3-2-1 backup rule?
It is the simplest way to avoid depending on a single copy. The United States cybersecurity agency (CISA) recommends it in its guide to backup options, for homes and businesses:
- 3 copies of every important file: 1 primary and 2 backups.
- 2 different types of media, to protect you from different risks (a disk failure is not the same as a mistake by a cloud provider).
- 1 copy off your premises.
The idea is that no single event, whether a fire, a damaged disk, an employee deleting what they should not, or an attack, leaves you without all the copies at once.
What does the 3-2-1 rule look like in a mid-sized business that uses an ERP?
For a mid-sized company, the most valuable asset is usually the ERP database (for example, Odoo) with customers, invoices, inventory and accounting, and its attachments (PDFs, invoice XML files, product photos). Here is how the rule translates:
| Copy | Where it lives | What it protects you from |
|---|---|---|
| 1. Production | The server where your team works | It is the copy you use; it protects against nothing on its own |
| 2. Automatic backup | Your hosting provider's backup system | Server failure, recent accidental deletions |
| 3. Independent backup | Another account, another region or another provider, with different credentials | An attack that compromises your main account, a serious provider error, a regional disaster |
The third copy is the one almost nobody has and the one that saves you on the worst day. What matters is not just that it is "somewhere else," but that whoever manages to get into your server cannot delete it.
Why isn't having a cloud backup enough?
Because ransomware goes straight for the backups. CISA warns in its ransomware guide that many variants look for accessible backups to delete or encrypt them. That is why it recommends keeping offline, encrypted backups of critical data, and regularly testing that they are available and intact.
In the cloud, "offline" is achieved with copies that cannot be modified for a set period. AWS, for example, offers Vault Lock in AWS Backup, which prevents deleting backups or changing their retention, and "logically air-gapped" vaults for immutable backups. Note: CISA asks you to use immutable storage carefully, because it does not meet the criteria of certain regulations; check it if your industry has its own rules.
What it costs you to go without: discovering, on the day of the attack, that the backup was on the same server or behind the same password, and that it was lost too.
How much information can you afford to lose?
That is the question that defines your strategy, and it has two parts:
- RPO (recovery point objective): how much work you can lose. If you back up once a day, you can lose up to a day of invoices, orders and transactions.
- RTO (recovery time objective): how long you can be without a system before the damage becomes serious.
For reference, Odoo publishes these objectives for its cloud: if a server fails permanently, an RPO of 24 hours (although it clarifies that for its online service it should be close to zero) and an RTO of 6 hours; if a data center is lost entirely, 24 hours for both. Odoo clarifies that these are not legally binding guarantees.
Do the exercise with your team: what happens if we lose today's work tomorrow? And if we cannot invoice for six hours? The answers tell you how often to back up and how much to invest.
What backups does your provider already include?
It depends on where your system lives. Check this before assuming it is "already backed up":
- Odoo Online: Odoo keeps 14 full backups for at least 3 months (daily for 7 days, weekly for 4 weeks and monthly for 3 months or more), replicated on at least three machines in different data centers in Europe and Canada, plus an immutable frozen copy. You can download a manual backup whenever you want: that download, stored elsewhere, can be your third copy.
- Odoo.sh: backs up the production database daily and keeps seven daily, four weekly and three monthly backups, with database and attachments. Staging environments are not backed up automatically, and manual backups last three days.
- Your own server (for example, on AWS): the backups are yours. Under the AWS shared responsibility model, the customer is responsible for managing their data. AWS Backup supports automatic plans, copies to another region or another account, and automatic restore tests.
If your server is in AWS's Mexico region, verify which features apply there: according to AWS Backup documentation, Mexico (Central) does have copy to another region, copy to another account, restore testing and logically air-gapped vaults, but not centralized cross-account management or Audit Manager. We explain the differences between hosting options in Odoo Online, Odoo.sh or your own server on AWS; if you would rather have someone take care of backups and tests, see our cloud infrastructure.
How often should you test that a backup works?
Regularly, and with real restores, not just by checking that the file exists. CISA, in its guide for small businesses, insists that testing partial and full restores is critical, and notes that some ransomware victims found that restoring took far longer than they expected.
The NIST cybersecurity framework, in its quick-start guide for small businesses, asks you to prioritize regular backups and their tests, and to verify the integrity of backed-up data before using it to restore.
In practice: once a quarter, restore the most recent backup in a test environment, measure how long it took and ask someone in accounting or sales to confirm the data is complete. Write down the result. If it took longer than your RTO, you know what to fix.
What should a minimum continuity plan include?
Backing up is half of it; the other half is knowing what to do the day everything fails. NIST's guide for small businesses suggests that a recovery plan include:
- The recovery steps in writing.
- Which resources are critical (people, systems, outside services) and in what order they are restored.
- Who is responsible for each part, with contact details.
- How and to whom you communicate: team, customers, vendors.
If your system handles customers' personal data, remember that the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties) requires administrative, technical and physical security measures against damage, loss, alteration or destruction of that data. A tested backup is part of complying with it. We cover security in general in basic cybersecurity for Mexican small and mid-sized businesses.
What are the most common backup mistakes?
- Backing up on the same server. If the server is lost, the backup is lost with it.
- Backing up only the database. In an ERP like Odoo, attachments (invoices as PDF and XML, photos) live separately; a backup without them is incomplete.
- The same credentials for everything. Whoever gets into your server gets into your backups.
- Never testing. The first restore attempt should not be on the day of the problem.
- Nobody is responsible. Without a named person who checks the backups, nobody finds out when they stop running.
Glossary
- Immutable backup
- A copy that cannot be modified or deleted for a defined period, even with administrator permissions.
- Ransomware
- Malicious software that encrypts your files and demands a ransom to return them.
- RPO
- The maximum amount of information you can lose, measured in time (for example, 24 hours of work).
- RTO
- The maximum time you can take to get back to operating after a failure.
- Restore
- Putting a system back into operation from a backup.
Frequently asked questions
What happens if my server goes down on a Friday afternoon?
It depends on two things decided beforehand: whether you have a recent backup outside that server and whether someone knows how to restore it and is available. With a written, tested plan, an outage is an annoyance; without one, it can mean a weekend without invoicing.
How often should I back up?
As often as the amount of information you are willing to lose. If losing a day of orders is unacceptable, you need backups more frequent than daily.
Does an external hard drive count as a backup?
Yes, as one of the two types of media, as long as it is kept outside the office or disconnected. If it is connected to the server all the time, ransomware can reach it.
If I use Odoo Online, do I already meet the 3-2-1 rule?
Odoo keeps several copies in different data centers. To have a copy under your control, download periodic backups from the control panel and store them outside Odoo.
Who should be in charge of backups?
A named person, in-house or at your provider, who checks that they run, performs the restore tests and reports the result to management.
Sources: CISA (US-CERT), “Data Backup Options”, Ruggiero and Heckathorn, 2012 · CISA, “#StopRansomware Guide”, September 2023 · CISA, “Cyber Guidance for Small Businesses”, April 2024 · NIST SP 1300, “CSF 2.0: Small Business Quick-Start Guide”, February 2024 · Odoo, “Odoo Cloud Hosting Service Level Agreement”, accessed November 2026 · Odoo documentation, “Odoo.sh: Branches” · AWS, “AWS Backup Features” · AWS, “AWS Backup feature availability” · AWS, “Shared Responsibility Model” · Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20-03-2025, last amended 14-11-2025)
