The 3-2-1-1-0 rule: the basis of a reliable backup strategy

Having a backup isn't the same as having a reliable backup. Many organizations only discover that when recovery is needed. The 3-2-1-1-0 rule is a widely used IT principle that gives structure to a backup strategy that holds up, even against a ransomware attack or hardware failure.

• 3 – At least three copies of your data. Your original data plus at least two backups. One copy is a single point of failure.
• 2 – At least two types of storage media. For example, a local server and a cloud service. If both copies sit on the same type of medium, they often fail together.
• 1 – At least one copy off-site. Physically separate from your main location, so fire, theft, or a local attack doesn't reach that copy.
• 1 – At least one copy offline or immutable. The key addition to the classic 3-2-1 rule. A permanently connected backup can be encrypted just as easily as the rest during a ransomware attack. An offline copy or a copy on immutable storage survives that attack.
• 0 – Zero errors on restore. A backup is only valuable if recovery demonstrably works: test regularly whether you can actually restore, not just whether the backup job reports "success."

Laws like the Dutch Cybersecurity Act (Cbw), which implements NIS2, and standards like ISO 27001 increasingly require organizations to demonstrate that recovery works, not just that a backup exists. The 3-2-1-1-0 rule is a practical starting point for that.

So when comparing providers, check whether immutable or offline storage is included by default, and whether recovery testing is part of the service. Both factor into our Security & compliance and Recovery & continuity criteria in the provider comparison, for example at Acronis, Mindtime, and Veeam.

More guides