What the 3-2-1 rule says
- 3 copies of your data: the original and two backups.
- 2 different media or systems, for example server storage and a separate backup system.
- 1 copy at another location, such as another building or a service provider.
The extended 3-2-1-1-0 rule
Against ransomware the classic rule is often not enough because malware also encrypts reachable backups. So you add one copy stored offline or immutable and verify that checks show zero errors. The last part is decisive: only a tested restore proves the backup works.
What you should define
- What is backed up? Servers, databases, configurations, cloud data such as mailboxes and files.
- How often? It depends on how much work you can afford to lose (recovery point objective).
- How fast back? Tolerable downtime determines technology and effort (recovery time objective).
- How long to keep? Consider retention periods and data protection.
- Who tests? A documented restore at least once per quarter.
Typical mistakes
Often the backup sits in the same network with the same credentials as production. Then an attacker encrypts both. Other mistakes are restores that were never tested, forgotten systems and cloud data where people assume the provider backs it up sufficiently. For Microsoft 365 or similar services, check the division of responsibility in the contract.