3-2-1 backup rule

What it means

The 3-2-1 backup rule recommends keeping at least three copies of important data on two different types of storage, with one copy kept off-site, for example in cloud storage or at another location. It is a simple and widely recognised principle for protecting against data loss.

Three copies means the original plus two backups. Two storage types, such as a server disk and an external drive or tape, protect against the failure of one technology. The off-site copy protects against fire, flood or theft that would destroy everything in one place.

Today the rule is often extended to 3-2-1-1-0: one copy should be immutable or disconnected from the network so that ransomware cannot encrypt it, and restores are tested regularly with zero errors. Attacks on backups are now a routine part of extortion.

How it works in practice

For a small firm the rule might look like this: data on a server or in a cloud application, a daily automatic backup to a network drive in the office, and another backup to a different cloud or to a disk taken off-site regularly. Accounting data and documents are among the most important.

Backup frequency follows from how much data the company can afford to lose, the RPO target. How quickly systems must be back is the RTO target. Both belong in the disaster recovery plan and should be approved by management, not just IT.

Testing restores is essential. A backup nobody has ever restored from is only an assumption. Every so often, check that both the whole system and individual files can be restored, how long it takes and whether the data are complete and readable.

What to watch out for

Cloud sync is not a backup. If a file is deleted or encrypted on a computer, the change often propagates to the cloud too. A real backup keeps older versions and is separated from the working environment with its own credentials.

Backups contain the same personal and business data as the original and must be protected just as well: by encryption, access control and retention limits. Losing an unencrypted backup drive is a data breach just as much as losing a server.