The 3-2-1 backup rule is a widely used guideline for how many backup copies to keep and where: three copies of your data, on two different types of storage, with one copy offsite. The idea is that no single failure, whether a broken disk, a software fault or a fire, should be able to destroy every copy at once. It is a rule of thumb rather than a formal standard, and many organizations now use extended versions that add protection against ransomware.
At a glance
- Three copies: usually the production data plus two backups.
- Two types of storage: so one platform’s failure or bug doesn’t take out both backups.
- One offsite: so a fire, flood or other local disaster at your site is unlikely to destroy every copy.
- Extended versions such as 3-2-1-1-0 add an immutable or offline copy and verified restores.
- It sets a baseline for copies and location; frequency, retention and testing still need their own policies.
What problem it solves
Many backup failures come from copies that share the same fate as the original. A backup on a disk in the same server dies with the server. A backup on a storage array in the same room is lost in the same fire or flood. A backup reachable from the same network, with the same administrator credentials, can be deleted or encrypted in the same ransomware attack.
The 3-2-1 rule is a simple way to avoid those shared failures. It is easy to explain to non-technical leaders, easy to check against a current setup, and widely recognized by IT teams, auditors and insurers. It gives a quick answer to “would our backups survive this?” for the most common kinds of loss.
How it works
Three copies. Keep the production data plus at least two backup copies. More copies mean more chances that at least one is intact and recent.
Two types of storage. Store backups on at least two different platforms or media. Historically this meant disk plus tape. Today it often means a local backup appliance or disk repository plus cloud object storage, as offered by many file systems and object storage services. The point is to avoid one bug, firmware fault or platform outage affecting every copy.
One offsite. Keep at least one copy in a separate location, far enough away that a local event doesn’t affect it. A cloud backup or backup as a service (BaaS) often fills this role.
Extended versions. Ransomware changed the threat. Attackers who get administrator access can reach every copy that is online and shares the same credentials. Variants such as 3-2-1-1-0 add one copy that is offline, air-gapped or immutable, and zero errors in restore testing. Some organizations simply treat an immutable or isolated copy as part of their 3-2-1 baseline.
Applying it beyond servers. The same thinking applies to SaaS data. Data in Microsoft 365 or Google Workspace lives on the provider’s platform; a separate SaaS backup copy keeps it recoverable if the account is compromised or data is deleted beyond built-in retention.
When it matters for buyers
- When reviewing an existing backup setup. It is a quick test of whether copies are diverse and separated enough.
- When cyber insurance renews. Insurers often ask how many copies you keep, where, and whether one is offline or immutable.
- When choosing a backup service. It helps you check whether a service, alone or with your local copy, gives you enough separate copies.
- When moving workloads to SaaS or cloud. It reminds you that the provider’s copy is still only one copy.
- When setting recovery targets. Copy frequency, which drives your recovery point objective (RPO), is a separate decision from how many copies you keep.
Questions to ask vendors
- How does your service fit into a 3-2-1 or 3-2-1-1-0 design with what we already have?
- Do you keep more than one copy of our backups, and in which separate locations or regions?
- Is at least one copy immutable or isolated from our credentials and network?
- What storage platforms do you use, and could one platform fault affect all our copies?
- How do you verify that backups restore, and how do you report results to us?
How it differs from immutable backup
The 3-2-1 rule is about how many copies you keep and where they live. Immutable backup is about whether a copy can be changed or deleted. A setup can follow 3-2-1 and still lose every copy if all of them can be deleted with one stolen admin account; an immutable copy can still be lost to a site disaster if it is the only one. The two work together, which is why extended versions of the rule now include an immutable or offline copy. Our backup as a service overview covers how providers support both.