Quick answer: The 3-2-1 backup rule is the most solid and simplest known strategy against data loss: keep at least 3 copies of your data, store them on 2 different media types and keep 1 copy offsite. The goal is to make it impossible for a single event (a disk failure, a fire, a ransomware attack) to destroy all your copies at once. With a modern addition this rule becomes 3-2-1-1-0: 1 copy must be offline or immutable so ransomware cannot reach it, and your backups must be tested regularly to confirm they restore with 0 errors. An untested backup does not count as a backup; because whether a backup actually works only becomes clear when a restore is attempted.

Backup is a topic everyone knows is necessary but most organizations do not take seriously until they experience a disaster. A disk failure, an accidentally deleted file or a ransomware attack can wipe out years of accumulated data in an instant. The 3-2-1 rule is a strategy developed against exactly these scenarios, and it has held for decades. This article explains what this rule is, why it works and how it has been updated against modern threats.

What the 3-2-1 rule is

The rule is summed up in three simple numbers. Three: have at least three copies of your data (the original plus two backups). Two: store these copies on two different media types (for example a local disk and the cloud). One: keep at least one copy physically elsewhere (offsite). This simple structure rests on a strong principle: no single event should be able to destroy all your copies at once.

Why does it work? Because it spreads risk. If one disk fails, another copy exists. If one media type (for example all local disks) fails, the copy of a different type saves you. If there is a fire or theft at your office, the offsite copy saves you.

The modern addition: 3-2-1-1-0

In the ransomware era the classic rule got an update. In its new form it becomes 3-2-1-1-0:

Number Meaning
3 At least three copies (original + two backups)
2 Two different media types
1 One copy offsite
1 One copy offline or immutable
0 Zero errors: backups tested and restorable

The two new numbers here are critical. Ransomware also encrypts network attached backups; this is why having at least one copy offline (air gapped) or immutable is the strongest defense against it. We detailed this in the ransomware first 24 hours article.

Zero: there is no untested backup

Perhaps the most neglected number is zero: backups must be tested regularly to confirm they restore with zero errors. Many organizations take regular backups for years, then discover in a disaster that the backups are corrupted, incomplete or unrestorable. The only proof that a backup actually works is trying to restore it. An organization that does not do regular restore tests only assumes it has a backup; it does not know.

Corporate backup plan

When building a backup strategy, clarify a few questions. How far back do you need to be able to go (recovery point objective)? How quickly do you need to be back to work after a disaster (recovery time objective)? Which data is most critical and priority? These questions determine how often and where you back up. Backup is also a cornerstone of a cyber incident response plan; because most of recovering from an incident rests on a solid backup. We covered why this is one of the first three steps for SMBs in the SMB 10 step cyber security article.

The KAOS and DSET approach

DSET assesses organizations' data resilience and backup strategy. When an incident happens, it works on the forensics and recovery side. Our local AI engine KAOS detects ransomware entry paths and risks to backups in an organization's infrastructure and reports every finding with a working proof. The goal is to ensure the organization can rely on a solid and tested backup in a disaster.

Frequently asked questions

I have a cloud backup, is this enough? Alone it is usually not enough. A cloud backup is an important copy but the 3-2-1 rule requires multiple copies and different media types. Also, if your cloud backup syncs continuously, a ransomware or an accidental deletion can spread corrupted data to the cloud too. This is why version history, delete protection and preferably an offline copy are also needed.

How often should I test my backups? Regularly, ideally at least every few months and after a major change. The test should be a real restore attempt; just seeing that the backup exists is not enough. Without trying to restore, you cannot know whether the backup is corrupted or incomplete. An untested backup gives the worst surprise in a disaster.

How is a backup protected against ransomware? At least one copy must be offline (air gapped) or immutable. Ransomware also encrypts network attached and writable backups; but a copy it can never reach or cannot alter saves you after an attack without paying. This is the most critical part of a modern backup strategy.

Sources

To assess your organization's backup strategy and data resilience, contact DSET. We provide security consulting from our Ankara Hacettepe Teknokent laboratory.