The 3-2-1 rule: backups that actually protect your data
A backup on the same server as the original data isn’t a backup, it’s a copy. The simple principle that tells the two apart.
The 3-2-1 rule predates the cloud but remains the reference standard: 3 copies of the data, on 2 different media, with 1 off-site.
Why 3 copies
The original data plus a single copy doesn’t survive corruption that hits both at once (a sync error, for instance). Three independent copies drastically reduce the odds that one incident wipes out everything.
Why 2 different media
A disk and a cloud backup, for example — not two identical disks in the same array. The goal is that a failure specific to one technology (a bad batch of drives, a software bug) doesn’t hit every copy.
Why 1 copy off-site
This is the most commonly neglected point, and the most critical: a fire, water damage, or ransomware that encrypts everything reachable from the local network must not be able to reach the backup copy.
What we test, not just what we configure
A backup that’s never been restored isn’t a reliable backup, it’s a hope. As part of IT Packs, we systematically schedule a quarterly restore test, off the production server — that’s what distinguishes a backup from a mere copy.
Frequently asked questions
What backup rule should an SME apply?
The 3-2-1 rule: three copies of the data, on two different media, one of them off site. It predates the cloud but remains the reference standard. A backup sitting on the same server as the original data is not a backup, it is a copy — a single incident can take out both.
Why do you need an off-site copy?
It is the most often neglected point, and the most critical one. A fire, water damage or ransomware encrypting everything reachable from the local network must not be able to reach the fallback copy. Off site means out of reach of the incident, not simply in another room.
How often should backups be tested?
A backup that has never been restored is not a reliable backup, it is a hope. As part of the IT Packs, we systematically schedule a quarterly restore test, off the production server. It is that test, not the configuration, that tells a backup apart from a mere copy.
Why two different media rather than two disks?
Because the point is that a failure specific to one technology — a bad batch of disks, a software bug — must not affect every copy. A disk plus a cloud backup satisfies the rule; two identical disks in the same array do not.
A question about your situation?
Take the self-audit — 93 questions, no sign-up — or ask for a free audit straight away: we’ll look at your specific case.