The 3-2-1 backup rule is a backup practice that calls for keeping at least three copies of your data (the original and two backups), stored on two different types of media, with one of them outside the office or main data center. Its current version, the 3-2-1-1-0 rule, adds one copy that cannot be modified or deleted and requires zero errors when you check that backups can actually be restored.
The rule was born to deal with disk failures, fires and theft. Today its main enemy is ransomware, which hunts down and destroys backups before encrypting data. That is where the two new numbers come from.
What the 3-2-1 rule is
Nobody keeps the deed to their house in a single drawer. The original is at home, the county records office has a copy and there is a scanned version on the computer. If there is a flood, the original is lost, but the other two are still there; if the computer fails, the paper remains. The 3-2-1 rule applies the same logic to a company's data:
| Number | What it means | With the house deed |
|---|---|---|
| 3 copies | The original data plus two backups. | The original and two copies. |
| 2 different media | For example, a local disk or NAS (network-attached storage) and the cloud, so a single technical failure can't affect all of them. | One paper copy and one digital copy. |
| 1 offsite | One copy in another physical location, away from whatever could damage the office. | The copy held by the county records office. |
What the rule prevents is a single point of failure: one event, whether a power failure, a flood or a theft, reaching the data and all of its copies at once. It is the same principle behind any disaster recovery plan (DRP): recovery can't depend on the place that failed.
Why people now talk about 3-2-1-1-0
Ransomware changed the picture. Before encrypting anything, attackers look for backups connected to the network and delete or encrypt them too, because they know a company without backups is a company that pays. We explain how they work step by step in our article on what ransomware is. That is why the rule added two numbers:
| Element | 3-2-1 | 3-2-1-1-0 |
|---|---|---|
| Copies | Three. | Three. |
| Media | Two different types. | Two different types. |
| Offsite | One. | One. |
| Immutable or offline copy | Not required. | One copy that nobody can modify or delete for a defined period, not even an administrator. |
| Verification | Not required. | Zero errors: backups are tested and confirmed to be restorable. |
The extra 1 protects you from an attacker who already has administrator passwords. The 0 protects you from a quieter enemy: the backup that has been failing for months without anyone noticing.
What the rule looks like in a company
A distributor with 90 employees, an ERP on its own server and email in Microsoft 365 can meet the full rule with this setup:
- Copy 1, the original: production data on the ERP server and in Microsoft 365.
- Copy 2, local: a backup every four hours to a NAS inside the office, on a separate network and with credentials different from those of the other devices. It is there to restore a deleted file quickly.
- Copy 3, in the cloud and immutable: a daily backup outside the office, locked against changes for 30 days. This covers both the "1 offsite" and the "1 immutable."
- The zero: every month a random file is restored and every quarter a full server, and the result is documented.
The day ransomware encrypts the server and the NAS, the cloud copy is still intact because nobody, not even an attacker with administrator passwords, could delete it. It is also wise for that copy to travel and be stored encrypted, so a third party can't read it even if they reach it; the details are in our guide to encrypted backups.
How often to back up and how long to keep it
The rule tells you where to keep the copies, but it doesn't say how often to make them. That depends on how much data each department can lose without real harm:
| Data | Suggested frequency | How long to keep it |
|---|---|---|
| ERP and billing | Every hour or continuously. | 30 to 90 days, plus month-end closes. |
| Email and files in Microsoft 365 or Google Workspace | Several times a day. | At least one year. |
| Shared folders | Daily. | 90 days. |
| Full servers | Weekly, with daily partial backups. | Four weeks. |
| Accounting and tax records | At every close. | As long as your tax and accounting obligations require. |
Frequency is, at its core, the RPO (recovery point objective) of each system: how much data you are willing to lose. We explain how to set it, with examples, in our guide to RTO and RPO.
Mistakes that break the rule
Many companies believe they follow the rule and find out on the day of the incident that they don't. These are the most common assumptions:
"OneDrive or Google Drive is already my backup." Those services sync files. If a file is encrypted or deleted, the change is copied everywhere, and the recycle bin only keeps items for a limited time.
"The NAS is in another room, so it's offsite." If it shares the network and passwords with the other devices, ransomware reaches it anyway, and so does a fire in the building.
"The backup runs on its own every night." Without someone reviewing failed jobs, it can go weeks without completing and nobody finds out until they need it.
"We've never had to restore, so it works." You only know it works once you test it. That is what the zero in the rule is for.
Testing restores is the step that gets postponed the most and the one that uncovers the most problems. What to test, how often and how to document it is covered in our guide to backup recovery tests.
Frequently asked questions about the 3-2-1 rule
Three copies of your data, on two different types of media, with one copy outside the main site. The 3-2-1-1-0 version adds an immutable or offline copy and zero errors when verifying that backups can be restored.
Yes, as a foundation. Applying it on its own is no longer enough: against ransomware, at least one of the copies has to be immutable or offline, and all of them should be tested regularly.
It is a copy that, once saved, cannot be modified or deleted for a defined period, even with administrator credentials. If an attacker gets into the account, they can see the backup but can't destroy it.
It is a backup with no permanent connection to the company network, such as a tape or a disk kept offline. It serves the same purpose as the immutable copy: an attack on the network can't reach it.
Yes, as long as it doesn't depend on the same accounts and passwords as your daily operations. If the attacker who gets into your network can also log in to the cloud backup console, that copy is no longer truly out of their reach.
Your IT team or a managed backup service, where an outside team monitors the backups and restores data when needed. That is how our cloud backup service works.
I'm passionate about SEO and copywriting at TecnetOne, where I combine my technical knowledge with optimization skills and persuasive writing. I use advanced tools and techniques to boost companies' online visibility, making sure they stay at the forefront of technology and achieve outstanding results in a competitive digital landscape. My goal is to build effective strategies that drive our clients' technological and commercial success.
