// Guide · Backup
The 3-2-1 rule: what sits behind the best-known backup formula
Three copies, two media, one other location — the rule takes a minute to explain. It gets interesting at the points where daily practice quietly breaks it.
// Why the rule exists
A backup only counts once it comes back
Nearly every company backs up its data. Considerably fewer know whether that data can actually be retrieved when it matters, and fewer still know how long the retrieval would take. The 3-2-1 rule is a rule of thumb aimed at precisely that gap: it makes sure no single event reaches every copy at the same time.
The rule comes from a time when data sat on tape and disk in your own building. It still holds, but it needs an addition: encryption attacks now go looking for the backup before they touch the live data. What that means for how a backup is built and run is described on our page about backup and disaster recovery.
This article explains the three digits, shows the extension now in common use, and names the data sets that simply do not appear in many backup concepts.
// The formula
What the three digits mean
Each digit rules out a different kind of failure. Only together do they give protection that survives more than one thing going wrong.
Three versions of the same data
The live data plus two backups. If one copy is lost or turns out to be unusable, another remains — and the usual cause is not a defect but a backup job that failed without anyone noticing.
Two different kinds of storage
Not both backups on similar systems in the same cabinet. Different technology means different failure modes, and the same operator mistake does not play out identically twice.
One copy off the premises
Fire, water, burglary or an attack on the whole network reach everything in the same place and on the same network. The off-site copy is the part of the rule most often missing in practice.
// Extension
Why 3-2-1 has become 3-2-1-1-0
The extra digits answer attacks that deliberately look for the backup before encrypting anything else.
One immutable copy
A backup that cannot be modified or deleted for a defined period after it is written — kept offline, or write-protected on the storage side.
- Stolen administrator credentials get an attacker nowhere here
- An operator mistake cannot overwrite this version either
- The retention period has to outlast the usual time to discovery
Zero errors on verification
The restore was actually performed and completed without findings. A green tick in a backup report is not what this means.
- Data is written back into a separate environment, not over the live system
- The check includes whether files and databases actually open
- The elapsed time is the honest answer to the question about downtime
// Verification
How a serious restore test runs
The test is the only evidence that the backup works. Everything else is an assumption with a green indicator next to it.
-
Decide in advance what gets tested
Not everything at once. Pick a system the business cannot run without, and a version of the data from a few weeks back.
-
Restore into a separate environment
The test must not touch live operation. An isolated environment also shows whether every component needed is genuinely in the backup.
-
Record the time it takes
From the start to a working system. That duration is the number that counts in an emergency, and it usually sits well above the estimate.
-
Have the business side check it
Someone from the department opens the data and confirms it is complete and current enough. A technically successful restore is not yet a usable data set.
-
Write down the result
Date, system tested, duration and anything noticed. That note is the only evidence you have when auditors or insurers ask whether testing happens.
// Blind spots
Data that appears in no backup
The rule usually gets applied to servers — and stops there. These holdings are missing from many concepts entirely.
- Mailboxes, file stores and notes in cloud services that nobody backs up separately
- Data on laptops that are rarely on the company network
- Configurations of firewalls, switches and access points
- Control and machine data on the production floor
- Encryption keys and recovery codes, without which a copy is useless
- The documentation itself — needed first in an emergency and often held only on the network
// Common questions
Questions that come up about backup
01 What exactly does the 3-2-1 rule say?
Three copies of the data, held on two different kinds of media, with one copy in another location. The original data counts as the first copy. The point behind it: no single event — no hardware failure, no fire, no encryption attack — should be able to reach every copy at once.
02 Does cloud storage count as the second medium or as the other location?
As the other location. Whether it also counts as a second medium depends on how it is implemented. The more useful question is whether one set of credentials grants access to both the live data and the backup — if so, from a security point of view they are the same copy.
03 What does the extension 3-2-1-1-0 mean?
The additional one stands for a copy that cannot be altered or deleted after it is written — held offline or stored immutably. The zero stands for zero errors on verification: the restore was actually carried out and it completed cleanly.
04 How often should a restore be tested?
At least once a year in full, and after any significant change to the systems or the backup software. A test means writing data back into a separate environment and opening it there — not reading a green line in a backup report.
05 What about data held in cloud services?
That is a widespread blind spot. Providers protect their own infrastructure against failure, not your data against accidental or malicious deletion. Mailboxes, file stores and notes therefore need a backup of their own that sits outside the service.
06 How long should backups be retained?
Long enough to survive damage that is noticed late. Tampering or a slow corruption often surfaces only after weeks — and if only the last few days are held, the last clean state has already been overwritten. Statutory retention periods apply on top of that.
Goes with this
All guides
When was your backup last restored?
If no date comes to mind, that is the usual finding. We review the state of your backups and carry out a restore — measured, with a record of what happened.