SustainedCloudWhat is the 3-2-1 backup rule?
The 3-2-1 rule says: keep at least three copies of your data (production plus two backups), on two different types of storage, with at least one copy off-site. It exists because the most common backup failure is a copy dying together with the original: same disk, same server, same building, or same ransomware infection.
Production
Copy 1 · the original
Backup on site
Copy 2 · different medium
Backup off site
Copy 3 · different location, offline or immutable
3 copies · 2 media · 1 off site
Why one backup is not enough
A NAS in the same office shares every fate with the server it protects: fire, water, theft, power surge. Ransomware goes further and actively searches for reachable backup targets to encrypt them first. A single copy on the same network is not a backup plan, it is a hope.
The modern version: 3-2-1-1-0
Current practice extends the rule: one copy offline or immutable (so ransomware cannot touch it), and zero errors in restore tests. The last digit is the one most companies skip. A backup that has never been restored is an assumption, and assumptions fail at the worst possible moment.
What off-site means in practice
Encrypted replication to a second site or to a datacenter, ideally in the EU. Off-site does not require a US hyperscaler: a second location of your own company, a colocation rack or a European storage provider all satisfy the rule while keeping the data under your control.
Calculator
How much backup storage do you need?
Needed today
600 GB
In 3 years
1 TB
Plan for
1.3 TB
Indicative values: one full backup plus daily incrementals, compression around 50%. For the off-site copy (3-2-1 rule), plan the same amount a second time.
FAQ
Common questions.
Is a NAS in the same office a real backup?
It is one of the two backup copies at best. It fails the off-site requirement and, if it is permanently reachable from the network, ransomware can encrypt it along with everything else.
How often should backups run?
That is your RPO question: how much work can you afford to lose? A nightly backup means up to a full day of orders and documents gone. For most businesses, critical systems deserve shorter intervals than the classic overnight job.
Book a free infrastructure assessment.
A no-commitment look at your setup. What's healthy, what's at risk, and what to fix first. Real answers, no pressure.