The 3-2-1 Backup Rule for Contractor Business Files

01Your working file is copy 1

It does. Count the estimate you’re editing as copy 1, then add two backups, not three. The rule doesn’t care what software made the file, only where each copy lives.

Say your office manager keeps every bid in one estimate folder on the office computer. Here’s how that folder adds up:

Each copy covers a different bad day. Copy 1 is the file your office needs to keep working. Copy 2 sits on a separate device, so a failed drive inside the office computer doesn’t take both. Copy 3 lives away from the building, so a break-in, a fire or a burst pipe at the office can’t take all three. “Two kinds of storage” means the copies don’t all sit on the same type of device. CISA’s example is a hard drive and the cloud, so an off-site cloud backup alongside the external drive covers it.

The count works the same whether the folder holds bids, change orders or supplier invoices. Start with the folder you’d least like to rebuild from memory, then move on to the next one. One folder done properly beats ten done halfway. For the bigger picture, see our guide to data backup for contractors.

02When three copies share one weak spot

Three copies on paper aren’t always three independent copies. Sometimes they quietly share the very thing that fails, and that’s easy to miss because each folder looks fine on its own. For each backup, ask what it has in common with copy 1.

Sync is the most common case. Microsoft’s OneDrive help explains that when you add, change or delete a file in your OneDrive folder, the same thing happens on the OneDrive website, and the other way around. So a folder that stays in step with the working estimate isn’t a second backup. If someone saves over a bid, the synced copy gets the same bad save a moment later. That’s the whole point of sync: it keeps your field crew and your office looking at the same file, which is useful right up until the file is wrong.

The disk comes next. Three folders on one disk are still one disk, and a single disk failure takes all of them. Calling them “Backup,” “Backup 2” and “Old bids” doesn’t change what they sit on.

Sign-ins matter too. If every copy uses the same cloud account, one stolen sign-in reaches all of them, whether it’s a password someone reused on another site or a shared login the whole office knows.

And some files never make it into the count at all. A job photo that never left the phone isn’t in the estimate folder, so it isn’t one of the three copies. Get the pictures into the shared job folder first, then count.

Run each backup through these checks before you count it:

For how a shared drive differs from a real backup, see cloud backup vs. cloud storage.

03Keep one copy offline and test a restore

Two more habits make the three copies harder to lose. They build on the count rather than replacing it.

CISA also recommends protecting backups with physical security, encryption and offline copies, and testing that your team can actually restore a file. The offline copy matters because ransomware (an attack that locks up your files and demands payment to unlock them) often tries to find and delete or encrypt the backups it can reach. An offline copy doesn’t make your files immune, but it does put one copy out of easy reach.

Some cloud vendors also offer immutable storage, which won’t let anyone change or delete the saved data. The same CISA guide says to use it with caution: it doesn’t meet the compliance requirements of certain regulations, and a misconfigured setup can get expensive. It protects a copy you already have. It doesn’t add a new one to the count. You may also run into “3-2-1-1-0,” which is a variation some backup vendors use, not the classic rule.

Finally, put a name next to each habit so one person in your office owns it. A backup nobody has restored from is still unproven. For how to check that a restored file actually opens, see backup testing.

04What Ghostworx covers

If Ghostworx looks after your IT, the backup on both plans covers the business data your coverage plan lists, usually business email and the OneDrive or Google Drive files for covered accounts. It’s kept separately from Microsoft or Google, checked and test-restored, so it’s a real backup rather than another folder that syncs.

Coverage is agreed during onboarding and stops at what the plan lists. Job photos uploaded to a covered folder from a phone are backed up, but photos left only in the camera roll aren’t. Files stored only on a computer aren’t part of the standard backup either, and neither are servers or network storage (NAS). Backup for those is quoted separately.

Your quote states how often backups run and how long versions are kept. When you count copies for a folder, go by what your plan actually lists, not what you assume it covers. The full list of what is and isn’t included is on our security and backup page.