Skip to content
English - United States
Schedule Consultation
  • There are no suggestions because the search field is empty.

What Is the 3-2-1 Backup Rule?

Three copies, two media, one off-site. Why the rule still holds, plus the modern add-on.

The 3-2-1 backup rule says to keep three copies of your data, on two different types of storage, with one copy off-site. It is decades old and still the simplest test of whether a backup plan will survive a real disaster. Modern practice adds one more requirement: at least one copy should be immutable.

What each number means

  • 3 copies. The live data plus two backups. One backup is never enough, because backup jobs fail quietly.
  • 2 media. For example, a local backup appliance plus cloud storage. If one technology fails or is compromised, the other survives.
  • 1 off-site. A fire, flood, theft or ransomware attack that hits the office should not hit the backup too. For most businesses today, off-site means cloud.

The modern addition: immutability

Ransomware groups delete or encrypt backups before they encrypt production data. A copy that cannot be changed or deleted for a set retention period, even by an administrator, defeats that. See what is an immutable backup.

What people get wrong

  • Assuming Microsoft 365 or Google Workspace is a backup. It is the live copy, not a backup. See does Microsoft 365 back up your data.
  • Backing up servers but not the laptops where real work lives.
  • Never testing a restore. A backup you have not restored is a hope. See how often should you test backups.
  • Keeping the off-site copy on a drive that is plugged into the same network.
  • Confusing backup with disaster recovery. See backup vs disaster recovery.

What good looks like

Automated backups of servers, cloud data and endpoints; a local copy for fast restores and a cloud copy for disasters; encryption in transit and at rest; immutability on the off-site copy; daily monitoring of job status; and scheduled restore tests with results recorded.

Mentis Group's Fully Managed IT program includes backups that are continuously monitored, tested and verified, following best practices for retention, immutability, encryption and geographic redundancy, with the results reviewed as part of Enhanced Cybersecurity planning.

Have a question about your own environment? Schedule a consultation with Mentis Group or call (866) 901-7808.