Malware and cyber defence, explained
The 3-2-1 backup rule, explained
The 3-2-1 backup rule says: keep 3 copies of your data, on 2 different kinds of storage, with 1 copy offsite. The original counts as one of the three. A newer version, 3-2-1-1-0, adds 1 copy that is offline or cannot be changed, and 0 errors when you test restoring it, because ransomware now goes after backups too.
Want to check your own setup? The free 3-2-1 backup checker tells you in a few clicks, and what to change if you fall short.
What each number means
| Number | Rule | What it protects against |
|---|---|---|
| 3 | Three copies of the data, counting the original | One copy failing, being deleted or corrupted |
| 2 | On two different kinds of storage | A fault that hits every copy on the same kind of storage, like a bad batch of drives |
| 1 | One copy offsite | Fire, flood or theft taking every copy in one building |
| +1 | One copy offline or immutable (3-2-1-1-0) | Ransomware and attackers deleting or encrypting every backup they can reach |
| 0 | Zero errors when you test a restore (3-2-1-1-0) | Finding out your backups do not work on the day you need them |
Why ransomware changed the rule
Ransomware attackers deliberately find and destroy backups before they encrypt anything, so a backup that stays connected can be lost with everything else.
A drive that is always plugged in, a network share mapped on every PC, a backup server joined to the same domain: an attacker with an admin account can reach them all. That is why the extra 1 matters. Offline means unplugged and put away. Immutable means stored with a lock that prevents changes or deletion for a set period, even by an administrator; many cloud and backup services offer it. How ransomware works shows where in an attack this happens.
Examples that meet 3-2-1
For one person
- The original on your laptop.
- An automatic backup to an external drive at home (Time Machine on a Mac, File History on Windows), unplugged between backups.
- A cloud backup service, which is the offsite copy and keeps old versions.
For a small business
- The original on the server or in the cloud apps the business uses.
- A nightly backup to a NAS in the office, on a separate account the rest of the network cannot sign in to.
- A cloud backup with immutability switched on, for 30 days or more.
- A restore test every quarter, written down, so the 0 in 3-2-1-1-0 is a fact, not a hope.
Common mistakes
- Treating sync as backup. A sync folder faithfully copies your mistakes and the ransomware's work.
- Never testing a restore. Many people find out their backup stopped months ago on the day they need it.
- Backing up the wrong things. Check that photos, documents, email archives and any app data you care about are actually included.
- Keeping the backup key with the backup. If your backups are encrypted, which is good, keep the password somewhere you can reach when the computer is gone.
Backups are the last line of defence in incident response: the recovery step depends on them. For the full picture of what they protect against, start with what malware is.
Questions people ask
Does the original count as one of the three copies?
Yes. Three copies means the data you work on plus two backups. Two copies on the same drive still only count once, because one failure takes both.
Is OneDrive, Google Drive or iCloud a backup?
A sync service is not a backup on its own: it copies deletions and encrypted files to every device within seconds. It becomes one if the service keeps earlier versions you can restore, and you know how to restore them. A dedicated cloud backup service, which keeps history by design, is the safer offsite copy.
How often should I back up?
As often as you can bear to lose work: if losing a day would hurt, back up daily. Automatic, continuous backup is best, because a backup you have to remember is a backup that stops happening.
Who invented the 3-2-1 backup rule?
It is usually credited to photographer Peter Krogh, who described it in his book on managing digital photo collections in the 2000s. It has since become the standard advice in IT and security.