Skip to content

Cybersecurity · 4 min

The 3-2-1 backup strategy: a practical guide

The 3-2-1 backup rule is a simple and effective strategy for protecting data: keep at least three copies, on two different types of media, one of which is stored offsite or offline. It is a proven principle that protects against hardware failures, human errors and attacks such as ransomware.

CybersecurityBackupData protection

Key points

  • 3-2-1: three copies, two different media, one offsite or offline.
  • The isolated copy protects against ransomware that encrypts connected backups.
  • It is a simple, proven rule, applicable to any company.
  • Backups must be tested periodically to be reliable.
The 3-2-1 backup rule: three copies of the data, two different media, one isolated copy offsite or offline.
The 3-2-1 rule: three copies, two media, one isolated.

What 3-2-1 means

The formula is easy to remember and to apply.

  • 3 copies of the data: the original plus two backups.
  • 2 different media: so you don't depend on a single type of device.
  • 1 offsite or offline copy: safe from local incidents and ransomware.

Why the isolated copy is crucial

The offline or immutable copy is what protects against ransomware: a backup that is always connected can be encrypted by the attack along with the original data. An isolated copy stays intact and allows recovery. It is the difference between having a backup and having a backup that works when you need it.

Test, always

A backup that has never been verified can turn out to be unusable at the very moment of need. The 3-2-1 strategy is completed with periodic recovery tests, to be certain that the data really is recoverable and within the expected time.

FAQ

Does the 3-2-1 rule also apply with the cloud? +

Yes. The cloud can provide one or more copies, ideally with immutable versions. The key is to keep diversified copies and at least one isolated.

How often should you back up? +

It depends on how much data you can afford to lose (RPO). For data that changes often, frequent or continuous backups; for other data, a daily frequency may be enough.

Is having backups enough to be protected? +

Only if they are isolated and tested. A backup that an attack can reach can be encrypted, and a backup that has never been tested might not work when you need it.

Want to apply these ideas to your company?

Tell us your goals and context: we reply with a concrete initial framing on AI, software, automation and digital marketing.

Request an assessment