Rule 3-2-1 reduces the risk of a single event destroying all copies. It provides a practical foundation that you can adapt to the value of the data, the acceptable downtime and the resources available.
The principle in one sentence
Keep three copies of your data, on two types of storage, with an off-site copy. The working data counts as the first copy; therefore, at least two additional backups are required.
This rule describes a distribution, not a product. A disk, local server and remote service can form a 3-2-1 strategy if the copies are truly independent.
Three copies to avoid the single failure point
Synchronization alone is not always enough. If a file is deleted or encrypted, the change can be replicated immediately. A backup must return to an earlier state.
A simple example for a small organization:
- files used daily on the computer or server;
- an automatic and versioned local backup;
- a remote encrypted and versioned backup.
Two types of storage to reduce common failures
Two folders on the same disk are not two separate storage types. A hardware failure or manipulation error can affect both. Use systems with different fault modes: internal storage and external disk, local server and object storage, or NAS and remote service.
Disconnecting or isolating some backups also limits the damage to malicious software or a compromised administrator account.
Off-site copy against local incidents
The remote copy protects against theft, fire, water damage or major electrical failure. It can be hosted in an online service or physically stored in another secure location.
Encrypt sensitive data before or during transfer. Keep separately the keys and information necessary for recovery, without making them inaccessible to the team responsible for recovery.
Versioning protects silent errors
Corruption can remain invisible for several days. If each backup immediately replaces the previous one, all copies may eventually contain the damaged file. Versioning retains several states according to a retention policy.
| Risk | Useful protection |
|---|---|
| Accidental deletion | Previous versions |
| Primary disk failure | Copy on another storage medium |
| Ransomware | Isolated or immutable copy |
| Local disaster | Off-site copy |
| Account compromise | Separate access and strong authentication |
An untested backup remains a hypothesis
Plan regular restorations. Choose a sample of files, check their contents and measure the time required. For a server or application, also test the database, configurations and secrets required.
- do automated backup jobs complete successfully;
- are failure alerts reviewed;
- are restored files readable;
- is the procedure understandable by another person;
- does the recovery time meet the requirement.
Start small, but check
First identify the irreplaceable data, add a versioned local copy and then an encrypted remote copy. Document the restoration before expanding the perimeter.
See the TechAtelier guidesRule 3-2-1 is not an absolute guarantee. It provides a robust structure that can be strengthened with immutable copies, integrity checks and adapted recovery procedures.
Published on 5 August 2026.