The rule in one line
3 copies of your data, on 2 different media, with 1 off site.
Three copies means the production data plus two backups. Two different media reduce the risk of a single defect, whether in a disk model, a storage system or a supplier, affecting all the copies at once. One copy off site protects against whatever hits the whole building: fire, flooding, theft.
An example for an SME: the data on the server, a backup on a NAS at the same site and a second copy in a data centre or a cloud backup service.
Why it's not enough
The 3-2-1 rule gives good protection against failures and physical disasters. Ransomware, however, is not a failure: it is an attacker who, before encrypting, looks for the backups in order to delete or encrypt them, leaving the company no alternative to paying the ransom. If all the copies can be reached from the company network with the same administrative credentials, to the attacker they are just one copy.
Then there is a second, more mundane problem: many backups are never tested. A copy that cannot be restored, or that takes a week to restore, is no protection.
The 3-2-1-1-0 variant
This is why the data protection industry has widely adopted an extension of the rule that adds two more digits:
- 1 offline or immutable copy: a copy that cannot be changed or deleted, not even by an administrator, for a set period. This can be achieved with physically disconnected media, such as tapes or removed disks, with immutable storage or with protected backup repositories.
- 0 errors: backups are checked and restores tested until the checks show zero errors.
| Digit | Meaning | Protects against |
|---|---|---|
| 3 | Three copies of the data | Loss of a single copy |
| 2 | Two different media or systems | Failure of a technology or a supplier |
| 1 | One copy off site | Fire, flooding, theft, local disasters |
| 1 | One offline or immutable copy | Ransomware, deliberate or accidental deletion, compromised accounts |
| 0 | Zero errors in checks | Backups that exist but cannot be restored |
What about data in the cloud?
Email, documents and chats in services such as Microsoft 365 are not automatically safe just because they are in the cloud. The provider guarantees that the service is available, but protecting the data against deletion, user error or compromised accounts remains largely the customer's responsibility: this is known as the shared responsibility model.
The recycle bin and retention policies help, but they are limited in time and scope and are not designed as an independent backup. File synchronisation is not a backup either: it faithfully replicates deletions and encryption too. Important data needs a copy on a separate system, which must also follow the rule.
How to check that your backups work
- Check the results every day, with automatic alerts for errors and jobs that did not run: a backup that fails silently is the worst case.
- Test real restores at fixed intervals: not just individual files but entire systems, in a separate environment.
- Time your restores: the measured restore time is your real RTO. Compare it with the one you decided on, as explained in the guide on RTO and RPO.
- Keep a written record: date, system, outcome, time taken, problems found.
- Protect access: dedicated credentials for the backup system, separate from the domain credentials and protected with multi-factor authentication.
Quick checklist
- I have at least three copies of important data, on two different systems;
- one copy is off site;
- one copy is offline or immutable;
- data in cloud services, such as Microsoft 365, is backed up to a separate system;
- I get an alert when a backup fails;
- the last full restore test is recent and documented;
- I know how long it really takes to restore critical systems.
If you do not know what each hour of waiting during a restore costs you, you can estimate it with the downtime cost simulator.