Every backup disaster we have ever been called into shared one feature: the business believed it had backups. The belief was sincere. There was software, there was a schedule, sometimes there was even a drive in a fireproof safe. What there was not, when the ransomware hit or the server died, was a copy that survived the same event that destroyed the original.
The 3-2-1 backup rule exists to make that outcome structurally impossible. It is the oldest piece of advice in data protection, it fits in a sentence, and businesses still get it wrong weekly. Here is the rule, why each number is there, the modern extension that ransomware forced on it, and how to check your own arrangement against it in five minutes.
The rule
Keep 3 copies of your data, on 2 different types of storage, with 1 copy offsite.
3 copies
The original plus two backups. One backup is not enough for reasons of simple arithmetic: at the moment of recovery, one copy is destroyed (that is why you are recovering) and your survival now depends on a single remaining copy being perfect. Backups fail quietly: corrupted files, half-finished jobs, a schedule that stopped in March. Two independent backup copies mean one silent failure is survivable rather than fatal.
2 different media
The two backup copies should live on different types of storage: not two folders on the same server, not two partitions of the same drive, and not two USB drives from the same shelf plugged into the same machine. Shared storage shares failure modes: one power surge, one controller fault, one malware infection takes both. Different media (say, local storage plus cloud) means no single technical fault can reach everything.
1 copy offsite
At least one copy lives somewhere physically and logically elsewhere. Fire, flood and theft take the building’s contents indiscriminately, including the backup drive in the drawer. Historically “offsite” meant tapes in someone’s car; today it almost always means encrypted cloud storage, which brings the offsite copy without the car.
Why the classic rule stopped being enough
The 3-2-1 rule was designed for fires and hardware failure. Ransomware attacks the rule itself: modern attackers deliberately locate and encrypt or delete backups before triggering the ransom, because a business with working backups will not pay. A cloud copy that syncs continuously is not protection here; it will faithfully sync the encrypted files over the good ones. A connected backup drive gets encrypted alongside the server it protects.
The industry’s answer is 3-2-1-1-0, which adds two requirements:
- 1 copy offline or immutable. A copy that cannot be altered from your network: either genuinely disconnected, or held in storage with immutability enforced (write once, no deletion within the retention window, whatever credentials an attacker steals). This is the copy that survives an attacker who has full control of your systems.
- 0 errors on verification. Backups are tested by restoring them, on a schedule, with the results checked. A backup that has never been restored is a theory. The number of businesses that discover their backups were failing only during an actual emergency is the entire reason this digit exists.
If you adopt one upgrade from this page, make it the zero: a calendar entry that says “restore something from backup and time it” once a quarter converts your backup system from assumed to known.
Applying the rule to a real small business
A typical SME setup that satisfies 3-2-1-1-0 without enterprise money:
- Copy 1: live data, on your server or in Microsoft 365.
- Copy 2: local backup to separate storage on-premises, for fast restores of everyday mistakes (deleted folder, overwritten file), because pulling terabytes back from the cloud takes time you may not want to spend.
- Copy 3: automated encrypted cloud backup, offsite by definition, with immutability enabled and retention long enough to reach behind a slow-burning problem (attackers commonly dwell for weeks before striking; 30 days of history is a minimum, not a target).
- Verification: scheduled test restores with the results recorded.
Two blind spots to check while you are at it. First, Microsoft 365 and other cloud data: Microsoft’s retention is not backup, and the shared-responsibility model leaves point-in-time recovery to you; cloud data needs its own copy under the same rule (our Microsoft 365 backup guide covers why). Second, the machines nobody lists: the laptop with the only copy of the pricing spreadsheet, the PC that runs the door entry. The rule protects what is in scope; scope is where arrangements actually fail.
This whole structure, run and verified for you, is what Backup as a Service packages; our data backup and recovery service covers the wider discipline including recovery objectives.
The five-minute self-check
- Count your copies. Is there really a third, or is it the same backup written twice?
- Would one power surge, one stolen login or one infected machine reach more than one copy?
- If the building burned tonight, where is tomorrow’s copy, physically?
- Could an attacker with your admin password delete every backup? If yes, you have no offline/immutable copy.
- When did anyone last restore a file, and is that written down anywhere?
Five confident answers and your arrangement is better than most. Any hesitation marks the gap to close first.
Frequently asked questions
What does the 3-2-1 backup rule stand for?
Three copies of your data (the original plus two backups), on two different types of storage, with one copy held offsite. It guarantees no single event, device failure or location loss can destroy everything.
What is the 3-2-1-1-0 rule?
The modern extension: 3-2-1 plus one copy that is offline or immutable (so ransomware with full network access still cannot touch it) and zero errors on scheduled restore verification.
Does OneDrive or Google Drive count as a backup?
Sync is not backup: it replicates changes, including deletions and encryption, within minutes. Cloud storage can host a backup copy, but only via proper backup software with versioning and retention, ideally with immutability.
Is a USB drive a good enough backup for a small business?
As one layer for fast local restores, fine. As the whole strategy, no: it is usually connected (so malware reaches it), on-site (so fire reaches it), and unverified (so nobody knows if it works). The rule exists precisely because single-copy arrangements feel safe and are not.
How often should backups run and be tested?
Backups: at least daily for business data, continuous for critical systems. Tests: restore something meaningful at least quarterly, and time it; the duration feeds your recovery planning as much as the success does.
Find out which copy you’re missing
Most businesses that check honestly find they have two copies and one shared failure mode. Our free IT health check includes a backup audit against exactly this rule (copies, media, offsite, immutability, and when a restore last actually happened) with plain-English findings and fixed prices for the gaps. Get in touch before you need copy three.
