Backups and the 3-2-1 Rule
On this page
Backups are the last line of defense against ransomware, hardware failure, and disaster — the thing that turns a catastrophe into an inconvenience. But a backup is only worth anything if it survives the event and actually restores. The classic 3-2-1 rule and two hard-won lessons — offline and tested — are what separate real resilience from a false sense of safety.
What is the 3-2-1 rule?#
| Number | Meaning |
|---|---|
| 3 | At least three copies of the data |
| 2 | On two different types of media |
| 1 | With one copy offsite |
The rule defends against single points of failure: a dead drive, a burned-down building, or a storage type that fails all at once cannot take every copy with it. Many now extend it to 3-2-1-1, adding one offline or immutable copy.
Why offline and tested?#
Two failures undo most backup strategies:
- Reachable backups get destroyed. Ransomware hunts and deletes backups it can reach. An offline (air-gapped) or immutable copy cannot be encrypted by a compromise — which is exactly why it is the copy that saves you.
- Untested backups do not restore. Corruption, missing data, and broken restore processes are discovered at the worst possible moment. A backup you have never restored from is a hope, not a plan.
Backups underpin disaster recovery and ransomware resilience. More at the Defense & Hardening hub.
Frequently asked questions#
What is the 3-2-1 backup rule?
The 3-2-1 rule says keep at least three copies of your data, on two different types of media, with one copy stored offsite. This guards against single points of failure — a device dying, a location disaster, or a single storage type failing — so that no one event can destroy all your copies at once.
Why must backups be offline or immutable?
Because ransomware and attackers specifically seek out and delete or encrypt reachable backups before striking. A backup an attacker can reach is a backup they can destroy. Offline (air-gapped) or immutable (write-once) copies cannot be altered by a compromise, so they survive to enable recovery.