Applying the 3-2-1 backup rule in a Mauritian SME

July 15, 2026 · 4 min read · SOVALYX Technologies

Three copies of your data, on two different types of media, one of them off-site: the 3-2-1 rule remains the simplest, most robust standard for business backups. In Mauritius it runs into a very concrete question — where do you put the off-site copy when you live on a cyclone-exposed island? — and it needs two additions that have become indispensable: immutability and restore testing.

The 3-2-1 rule in one minute

Originally coined for digital photography and since adopted as a reference by cybersecurity agencies, the rule fits in three numbers: keep three copies of any important data (the production version plus two backups), on two different types of media, with one copy off-site. Its strength is that it assumes no particular technology: it reasons in failure modes. Each requirement eliminates a family of disasters — human error, hardware failure, physical loss.

Three copies: synchronisation is not a backup

The most widespread misunderstanding in SMEs: believing that syncing to OneDrive, Google Drive or Dropbox counts as a backup. Synchronisation faithfully propagates everything — including the accidental deletion, the file encrypted by ransomware, an employee's mistake. Minutes later, the "copy" is exactly as damaged as the original.

A real backup is a frozen snapshot, taken at regular intervals, kept with version history and restorable independently of the source system. Count your copies by that criterion: many businesses that believe they have three actually have one and a half.

Two media: don't put every egg in the same failure mode

Two different media means two technologies whose failures are independent: a local NAS and remote object storage, disk and tape, a backup server and a cloud repository. If your three copies live on three disks in the same array, bought the same day from the same supplier, you do not have two media — you have the same risk three times. The test is simple: what single event could destroy both media at once? If one exists, separate further.

One copy off-site… on an island?

Off-site means, first of all, outside your premises. Against fire, water damage, theft or vandalism, a copy in a data centre on the other side of the island does the job perfectly. A major cyclone, however, crosses the whole island — and the risk becomes shared between both sites again.

The answer is not necessarily to ship your data abroad, with the applicable-law and transfer questions that raises. A data centre engineered for cyclonic conditions — reinforced building, backed-up power, redundant links — withstands wind and rain far better than an ordinary company office: what a cyclone mostly threatens is the electricity and connectivity of unprepared sites. For the most critical data, a fourth copy abroad, encrypted under your own keys, can complement the setup without replacing it. We cover this seasonal preparation in our article on disaster recovery through cyclone season.

What 3-2-1 doesn't say: immutability and restore testing

The rule predates the ransomware era. An attacker who gains administrative rights will go for your backups first — all three copies, if they can. Hence the modern requirement of an immutable backup: at least one copy that, once written, can be neither modified nor deleted for a defined period, even with administrator rights. That is the point of the 3-2-1-1-0 variant: one immutable or offline copy, and zero errors in restore testing.

Because a backup that has never been restored is an assumption, not a protection. Test full restores — not a single file: an entire server, a database, stopwatch in hand. The measured time is your real RTO, and it almost always surprises; our RTO/RPO guide explains how to set those targets. In Mauritius, an immutable repository hosted on a local private cloud — such as the one SOVALYX operates — provides the off-site copy without sending your data off the island.

Your SME's 3-2-1 checklist

• Inventory the vital data: files, databases, email, configurations.
• Count real copies: synchronisation does not count.
• Check the media: two technologies with independent failure modes.
• Get one copy off-site, outside your premises and outside your network.
• Enable immutability on at least one backup repository.
• Isolate access: backup credentials separate from the directory, with MFA.
• Test a full restore and note the duration: that is your measured RTO.
• Schedule the test before cyclone season, then at regular intervals.
• Document who restores what, in what order, with which keys.
• Have the setup audited once a year — an outside eye spots in an hour the gaps you no longer see.

🧰 The companion tool: What does one hour of downtime cost you? — free · 2 minutes.

Reviewed and optimised by AI.