What is the 3-2-1 backup rule?
The 3-2-1 backup rule is a rule of thumb for how many backup copies to keep and where to keep them. No standard requires it, but it is widely used because it is easy to check against a real setup:
- 3 copies of the data in total: the production copy plus at least two backups.
- 2 different types of storage media or systems, so a single failure mode, such as a firmware bug in one appliance, can't affect every copy.
- 1 copy offsite, far enough away that a fire, flood or theft at the main site doesn't reach it.
Example: a small office setup
An accounting firm keeps its client files on a file server, which is copy one. A backup job writes nightly versions to a network storage appliance in a different room, copy two on a separate system. The appliance then sends each night's backup to cloud object storage in another region, copy three, offsite. A failed server is restored from the appliance in an hour, and a fire that destroys the office is survived through the cloud copy.
The 3-2-1-1-0 extension
The original rule mostly assumed accidents. Ransomware operators look for backups on purpose, and if the appliance is domain-joined and the cloud account uses the same admin credentials, one stolen account can delete all three copies. Some backup vendors therefore promote 3-2-1-1-0:
- the extra 1 is a copy that is offline or immutable, such as tapes removed from the library or cloud storage with object lock in compliance mode;
- the 0 is zero errors when backups are verified by test restores.
For the accounting firm, that means turning on object lock for the cloud copy, moving it to a separate account with its own MFA-protected credentials, and running a scheduled test restore.
What the rule doesn't cover
- Versions and retention: three copies of last night's encrypted files are no help. The copies must keep older restore points, usually under a rotation scheme such as grandfather-father-son, reaching back further than an attacker may have been hiding.
- Replication and RAID: a live replica or a mirrored disk copies deletions and encryption immediately, so it doesn't count as a backup copy.
- Snapshots on the same array: they fail with the array and are a favorite target for deletion, so they count only once copied elsewhere.
- Keys and restores: encrypted backups need their keys stored where they survive the outage, and a backup that has never been restored is only an assumption.
3-2-1 backup rule on the CompTIA Security+ exam
The 3-2-1 rule is taught under SY0-801 objective 3.4, which covers resilience and recovery, alongside offsite backups and the immutable backups that SY0-801 added. Wording such as "a fire at headquarters destroyed the server and its backups" points to the missing offsite copy, and "the attacker used domain admin rights to delete every backup" points to an offline or immutable copy. Distractors include RAID, replication, snapshots on the same storage and simply backing up more often, none of which survive a site loss or a stolen admin account. The 3-2-1 backup rule also appears in A+ Core 2 (220-1202) objective 4.3.