Key takeaways
- The 3-2-1 backup rule means keeping three copies of your data, on two different types of storage, with one copy off-site.
- It protects against hardware failure, accidental deletion, theft, fire and ransomware.
- Many organisations extend it to 3-2-1-1-0: one copy offline or immutable, and zero errors when restores are tested.
- Cloud services such as Microsoft 365 still need independent backups.
- A backup is only proven when you have tested restoring from it.
The 3-2-1 backup rule is a simple data protection strategy: keep at least three copies of your important data, store them on two different types of storage, and keep one copy off-site. It is widely recommended because it ensures that no single failure, whether a broken disk, a stolen laptop, a fire or a ransomware attack, can destroy every copy of your business data.
What each number means
- 3 copies: your live data plus at least two backups.
- 2 types of storage: for example, a local backup device and cloud storage, so one type of failure does not affect both.
- 1 off-site copy: a copy stored in a different physical location, typically in the cloud, protecting you from fire, flood or theft.
Why the 3-2-1 rule matters for businesses
Data loss rarely comes with a warning. Hardware fails, files are deleted by mistake, laptops are lost and ransomware can encrypt everything a user can reach, including backups connected to the same network. Following the 3-2-1 rule means you always have a clean copy to recover from.
The modern version: 3-2-1-1-0
Because ransomware often targets backups directly, many organisations now use an extended rule:
- 1 offline or immutable copy: a backup that cannot be altered or deleted for a set period, or is disconnected from the network.
- 0 errors: backups are monitored and restores are tested, so you know they will work when needed.
Not sure your backups would work?
Ignite System sets up, monitors and tests backups as part of our managed IT services.
How to apply the 3-2-1 rule in your business
- Identify what matters. List your critical data: files, databases, email, accounting systems, websites and line-of-business applications.
- Decide how much you can afford to lose. Your recovery point objective (RPO) is how much recent data you could lose, and your recovery time objective (RTO) is how quickly you need to be running again.
- Choose backup tools. Use reliable software that supports scheduling, encryption, versioning and alerts.
- Combine local and cloud backups. A local copy allows fast restores, while a cloud copy protects against site-wide disasters.
- Protect the backups. Use separate credentials, multi-factor authentication, encryption and immutable storage where possible.
- Test restores regularly. Restore individual files and, periodically, a whole system.
Do cloud services need backing up?
Yes. Services such as Microsoft 365 and Google Workspace are highly available, but availability is not the same as backup. Retention periods are limited, and a deleted or encrypted file can be synced everywhere. An independent backup of email, OneDrive, SharePoint and Teams data closes that gap. See our Microsoft 365 security checklist for more.
How often should you back up?
It depends on how quickly your data changes and how much you could afford to lose. Many businesses back up critical systems at least daily, with more frequent backups for databases and shared files. Your RPO should guide the schedule.
Frequently asked questions
It means keeping three copies of your data, on two different types of storage, with one copy stored off-site, so that a single failure or disaster cannot destroy all copies.
Not necessarily. File sync services such as OneDrive or Dropbox copy changes, including deletions and ransomware encryption, to every device. A true backup keeps separate, versioned copies you can restore from.
Test regularly, at least by restoring sample files frequently and performing a full system restore test periodically. Monitoring should alert you immediately if a backup fails.
An immutable backup is a copy that cannot be changed or deleted for a set period, even by an administrator. It is an important defence against ransomware that targets backups.
Want peace of mind about your data? Ask Ignite System for a backup review.
