The 3-2-1 backup rule recommends three copies of important data, on two different types of storage, with one copy kept offsite. Modern variations add an immutable or offline copy and verified restores.
Key takeaways
What to know before you act
- 3-2-1 means three copies of data, on two different types of storage, with one copy offsite.
- Modern guidance often extends this to 3-2-1-1-0: one immutable or offline copy and zero errors in restore testing.
- The rule is a minimum; recovery objectives determine how often and how quickly you need to restore.
Why it matters
What business leaders should understand
A single backup on the same network as production data can be lost to ransomware, hardware failure, or a site disaster. Following 3-2-1 makes it far more likely that at least one usable copy survives.
The right response should reflect your environment, data, vendors, risk, and operational priorities. Use this guide as a practical starting point, then validate important decisions with the people responsible for your technology, cybersecurity, legal obligations, and insurance coverage.
Learn how Meta IT Pro can help with backup and disaster recovery, business continuity planning, and incident response services.
Related reading: Cloud backup for small businesses and RTO vs. RPO explained.
What each number means
The rule is designed so no single failure—a disk crash, ransomware, theft, or a fire—destroys every copy of important data.
- 3 copies: the production data plus two backups.
- 2 media types: for example, a local backup appliance and cloud storage.
- 1 offsite copy: physically or logically separate from the primary location.
Why ransomware changed the rule
Modern ransomware operators look for backups and try to delete or encrypt them before deploying ransomware. If every backup copy can be reached with the same administrator credentials, the 3-2-1 structure may not help.
That is why many organizations add an immutable copy that cannot be modified or deleted for a set period, or an offline copy that is disconnected from the network. Regular restore testing confirms the backups are complete and usable.
- Use separate credentials and MFA for the backup system.
- Enable immutability or object lock where the backup service supports it.
- Monitor backup jobs and investigate failures promptly.
- Test file-level and full-system restores on a schedule.
Practical action plan
Steps your business can take
Identify which systems and data must be backed up.
Keep at least one copy offsite or in the cloud.
Protect one copy from deletion with immutability or offline storage.
Test restores regularly and record the results.
Recommended next steps
Continue from this article.
These pages expand the specific risks and decisions covered in this guide. Use them to move from general understanding to the service, tool, or related topic that best matches your next question.
Related guide
Cloud backup for small businesses
Choose a service for your offsite copy.
Explore nextRelated guide
RTO vs. RPO explained
Set how quickly and how far back you need to restore.
Explore nextRelated guide
Does Microsoft 365 need a backup?
Apply 3-2-1 thinking to cloud email and files.
Explore nextService
Ransomware recovery
Restore operations in a controlled order after an attack.
Explore nextWarning signs
Do not ignore these indicators
- All backup copies are reachable with the same administrator account
- The only backup is a USB drive attached to the server
- Backup success emails are not reviewed
How Meta IT Pro can help
Related services and practical next steps
Explore the services connected to this topic. These links provide more detail about scope, safeguards, support, and how to start a conversation with our team.
Authoritative references
Sources and further reading
These primary sources support the guidance in this article and provide additional technical or consumer information.
National Institute of Standards and Technology
Protecting Data from Ransomware and Other Data Loss Events
A practical guide for small organizations on backup, recovery, and protecting data from loss events.
Cybersecurity and Infrastructure Security Agency
#StopRansomware Guide
Preparation, prevention, response, and recovery guidance for ransomware and data-extortion incidents.
National Institute of Standards and Technology
NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
Contingency planning guidance, including business impact analysis and recovery objectives.
Need help with your IT solution?
Get practical guidance from a local IT and cybersecurity team.
Meta IT Pro helps Massachusetts and Rhode Island businesses improve support, security, Microsoft 365, Google Workspace, networks, backup, recovery, and compliance readiness. Tell us what is not working - or what you want to improve - and we will help identify a sensible next step.