3-2-1 backup rule
Also known as: backup strategy · 3-2-1 rule
The 3-2-1 rule recommends keeping three copies of your data, on two different media, with one of them off site.
Each number answers a failure mode. Three copies cover silent corruption; two media cover a technology failing; the off-site copy covers fire, flood and theft.
Ransomware added a requirement the original rule did not cover: at least one copy must be beyond the reach of an attacker holding administrative rights — offline, or immutable.
A backup never restored is not a backup, it is an assumption. The restore test is the only proof the chain works.
What it means for a small business
Cloud sync is not a backup: it propagates deletion and malicious encryption to every copy, exactly as it propagates a legitimate change.
Related terms
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.