The Rule
The 3-2-1 backup rule is the simplest, most quoted advice in data protection:
- 3 copies of your data
- on 2 different media types
- with 1 copy stored off-site (or offline)
It was coined long before ransomware existed, but ransomware is exactly the threat it now defends against most effectively.
Why "Three"?
The original is your live data. The second copy protects against hardware failure. The third protects against a correlated failure — one event that affects both your live data and your local backup at the same time.
Examples of correlated failures:
- A fire, flood, or theft.
- A power surge that fries your computer and the USB drive plugged into it.
- A ransomware strain that encrypts your NAS share alongside the source.
Why "Two Different Media"?
Storage media fail in characteristic ways. Magnetic disks fail mechanically. SSDs lose data over years of disuse. Optical media degrade. Tape requires specific drives. Diversifying media types makes it unlikely that a single failure mode wipes out everything.
For most people in 2026, "two different media" maps to one of:
- Internal SSD + external HDD
- Local NAS + cloud backup
- Live storage + cold cloud storage (S3 Glacier, Backblaze B2)
Why "One Off-site"?
The off-site copy is the one that has to survive a building fire, a burglary, or a ransomware outbreak. It must be:
- Geographically separate from your live data, or
- Logically separate — meaning the credentials that grant write access on your live system cannot reach the backup.
This second case is the crucial one for ransomware. A "cloud backup" that any process on your laptop can encrypt is not really off-site for ransomware purposes.
A Practical Setup for Individuals
| Copy | Where | Cost | Recovery time |
|---|---|---|---|
| 1 | Your laptop SSD | — | Instant |
| 2 | External USB SSD, plugged in weekly | €60 once | Hours |
| 3 | Cloud backup with object lock / immutability | €5/month | A day |
The crucial detail: the cloud bucket has object-lock or versioning enabled so that a compromised laptop cannot delete or overwrite the backups.
A Practical Setup for a Small Team
| Copy | Where | Notes |
|---|---|---|
| 1 | Production server | Hot data |
| 2 | On-site NAS | Daily snapshots, retained for 30 days |
| 3 | Offsite S3 with versioning + Object Lock (compliance mode) | Daily/weekly; immutable |
The NAS protects against accidental deletion and quick recovery. The S3 copy protects against a full-site disaster and ransomware.
Test Your Restore — Always
A backup you have never restored is not a backup; it is a hope. Schedule a quarterly restore drill:
- Pick a random file or system.
- Restore it from each backup layer to a different device.
- Confirm the data is identical and usable.
- Time the restore — would you accept that downtime in a real incident?
The most painful moment in any organisation's life is discovering that their backups have not been working for six months — on the day they finally need them.
The Modern Addition: 3-2-1-1-0
Some practitioners now use 3-2-1-1-0:
- 3 copies, 2 media, 1 off-site,
- 1 immutable / offline copy,
- 0 errors verified by restore tests.
Whatever you call it, the principle is the same: redundancy, separation, immutability, and proof.
Conclusion
Ransomware groups know that organisations without functional offline backups have to pay. Having the discipline to follow the 3-2-1 rule — and to actually test the restores — is the single highest-leverage defensive investment you can make.