Cybersecurity · 4 min
The 3-2-1 backup strategy: a practical guide
The 3-2-1 backup rule is a simple and effective strategy for protecting data: keep at least three copies, on two different types of media, one of which is stored offsite or offline. It is a proven principle that protects against hardware failures, human errors and attacks such as ransomware.
Key points
- 3-2-1: three copies, two different media, one offsite or offline.
- The isolated copy protects against ransomware that encrypts connected backups.
- It is a simple, proven rule, applicable to any company.
- Backups must be tested periodically to be reliable.
What 3-2-1 means
The formula is easy to remember and to apply.
- 3 copies of the data: the original plus two backups.
- 2 different media: so you don't depend on a single type of device.
- 1 offsite or offline copy: safe from local incidents and ransomware.
Why the isolated copy is crucial
The offline or immutable copy is what protects against ransomware: a backup that is always connected can be encrypted by the attack along with the original data. An isolated copy stays intact and allows recovery. It is the difference between having a backup and having a backup that works when you need it.
Test, always
A backup that has never been verified can turn out to be unusable at the very moment of need. The 3-2-1 strategy is completed with periodic recovery tests, to be certain that the data really is recoverable and within the expected time.
FAQ
Does the 3-2-1 rule also apply with the cloud? +
Yes. The cloud can provide one or more copies, ideally with immutable versions. The key is to keep diversified copies and at least one isolated.
How often should you back up? +
It depends on how much data you can afford to lose (RPO). For data that changes often, frequent or continuous backups; for other data, a daily frequency may be enough.
Is having backups enough to be protected? +
Only if they are isolated and tested. A backup that an attack can reach can be encrypted, and a backup that has never been tested might not work when you need it.
Want to apply these ideas to your company?
Tell us your goals and context: we reply with a concrete initial framing on AI, software, automation and digital marketing.
Request an assessment