3-2-1 backup rule
Also known as: 3-2-1 rule, 3-2-1-1-0, backup rule, backup strategy
The 3-2-1 backup rule is a time-tested formula: keep at least 3 copies of your data, on 2 different types of storage, with 1 copy kept offsite.
It protects against the full range of failures (a deleted file, a dead drive, a fire, or ransomware) because no single event can wipe out every copy.
3-2-1 backup rule, explained at three levels
At home
Think of your house keys. If you have one key and lose it, you're locked out. If you keep a spare in a drawer, a fire could still take both. Leaving a third with a trusted neighbour solves that. The 3-2-1 rule applies the same logic to data: three copies, on two different kinds of storage, with one kept at another location.
At work
The 3-2-1 backup rule is a baseline design for backups: keep at least three copies of important data, store them on two different types of media, and keep one copy offsite. For a business, it means no single failure, such as a dead drive, a stolen laptop, a fire, or a ransomware attack, can destroy every copy of the data needed to keep operating.
At home
Each number targets a different failure. Three copies, meaning the original plus two backups, cover a single copy failing. Two media types, such as your computer's drive and an external drive or cloud storage, protect against one kind of storage failing in the same way. One offsite copy, often a cloud backup service like Backblaze, covers fire, flood, or theft at home. Together, it takes several unrelated disasters to lose everything.
At work
In a business, 3-2-1 usually looks like this: production data on the server or in Microsoft 365, a local backup on a backup appliance or NAS for fast restores, and a third copy replicated to a cloud backup provider. Ransomware changed the rule, because attackers now hunt for and delete reachable backups. The 3-2-1-1-0 extension adds one offline or immutable copy and zero errors, confirmed by tested restores.
At home
The rule counts copies, but recovery depends on what those copies contain and how far back they go. If ransomware or corruption sat unnoticed for two weeks, your three most recent copies may all be damaged. That's why version history and retention length matter as much as copy count. While 3-2-1 sounds old-fashioned, in my view it's still the clearest way to check whether a backup plan has an obvious single point of failure.
At work
Modern implementations design around recovery objectives rather than copy counts. The recovery point objective (RPO) sets backup frequency, and the recovery time objective (RTO) sets whether you need local images or cloud failover. Immutability comes from object lock on S3-compatible storage or from air-gapped media. Separate credentials for the backup system matter, because attackers who gain domain administrator rights routinely log into backup consoles and delete jobs. Restore tests prove the zero in 3-2-1-1-0.
Real-world examples
At home
Lena kept her business files only on her laptop until the drive died with no warning. She lost months of work. Afterward, her MSP set up 3-2-1: files on the laptop, a local backup drive, and an automatic cloud copy, so a single failure can never wipe her out again.
At work
When ransomware encrypted Marcus's office server and the attached backup drive, the third copy (an immutable cloud backup) was untouchable. Because they followed 3-2-1 with an immutable offsite copy, they restored everything without paying, exactly as the rule intends.
Common confusions
- Syncing to cloud storage counts as a backup — Sync services mirror changes (including deletions and ransomware encryption) to the cloud too. True backup keeps separate, versioned copies you can restore from a point before the problem occurred.
- One backup copy is enough — A single backup can fail, be stolen, or be encrypted along with the original. The whole point of 3-2-1 is that no single event destroys every copy.
- If backups are running, we're safe — Backups fail silently all the time. Only tested restores prove your data can actually be recovered when it matters.
For analysts
Ask three questions to check any backup setup against 3-2-1: How many copies exist, are they on different media with one offsite, and is at least one copy offline or immutable against ransomware? If any answer is uncertain, that's your priority fix.
History & origin
The 3-2-1 rule was popularized by photographer Peter Krogh in the mid-2000s as a memorable way to describe resilient backups, and it spread across the IT world as a baseline standard. As ransomware learned to seek out and destroy connected backups, the rule evolved. Practitioners now often extend it to '3-2-1-1-0': adding one offline or immutable copy and zero errors verified by testing.