Backup Strategy: The 3-2-1 Rule and What It Misses

Taking backups and being able to rely on them are different things. Here is the long-standing 3-2-1 rule and the clause today's threats make necessary.

Most companies that lose data did in fact have a backup system. The problem is not the absence of backups but their failure at the moment of need. Corrupted, incomplete or attacker-deleted backups produce the same outcome as having none. A good strategy accounts for those possibilities up front.

What is the 3-2-1 rule?

The long-standing reference consists of three clauses:

• 3 copies: The original plus at least two backups.
• 2 different media: Not all on the same type of disk. Identical hardware from the same batch can fail together.
• 1 copy off-site: Fire, flood or theft takes everything at a single address.

Together these close most hardware-failure and physical-disaster scenarios.

The missing clause: immutability

The 3-2-1 rule took shape before ransomware became widespread. A significant share of today's attacks reach the backups first, deleting or encrypting them, and only then touch the primary data. A backup drive that is permanently connected is simply a second target.

So the rule needs one more clause: at least one copy must be immutable or offline. Storage that cannot be deleted for a defined period, or a physically disconnected disk, satisfies this.

Set frequency by acceptable loss

Backup frequency is a commercial decision, not a technical one. The question is: how many hours of data can we afford to lose? A company backing up daily loses, at worst, a day of work. If that is acceptable, daily is enough; if not, increase the frequency.

The second question concerns recovery time: when a system fails, how quickly must it be running again? Without those two numbers, no backup design can be evaluated.

An untested backup is not a backup

This is the most critical and most skipped item. A backup job reporting success says nothing about whether a restore works. Run a genuine restore drill at least annually: not a single file, but a full system, and measure how long it takes.

Write it down

Which system is backed up where, how often, and retained for how long? If that information lives only in one person's head, nobody will know what to do during an incident while that person is away. A short document becomes your most valuable asset in a crisis.