The 3-2-1 rule is the proven rule of thumb of data protection: at least three copies of the data (original plus two backups), on two different media types, one copy of which is kept at another location. It protects against the most common loss scenarios — hardware failure, operator error, fire, theft.
Against ransomware the classic scheme alone is no longer enough: attackers deliberately encrypt reachable backups too. Modern variants therefore extend to 3-2-1-1-0 — additionally one offline or immutable copy and zero errors in regular restore testing.
The rule in detail
Three copies means: the original counts, plus two independent backups — independent also meaning: not on the same storage, not in the same failure domain. Two media types separate failure classes, say disk and object storage or disk and tape; a firmware bug or controller defect then does not hit both.
The off-site copy separates spatially: another data center, another fire compartment, the cloud. Logical separation matters just as much — separate credentials, a separate administration domain. A backup reachable with the same admin credentials as production falls with it.
From 3-2-1 to 3-2-1-1-0
- The additional 1: one copy offline (air gap) or immutable.
- The 0: zero errors in restore tests — backups only count once recovery is proven.
- Separate credentials and MFA for the backup infrastructure.
- Measure recovery time realistically: RTO applies to restoring, not to backing up.