ALKNETWORK 
What is the 3-2-1 Backup Rule?
The 3-2-1 rule means:
- 3 copies of your data
- 2 different types of storage media
- 1 copy stored offsite
The purpose is to make sure that a single failure does not destroy both the production data and all available backups.
A simple example:
This is why simply having a backup is not enough.
The backup itself also needs protection.
For stronger protection, the backup copy can use:
- Offline storage
- Air-gapped storage
- Immutable storage
- Offsite storage
3-2-1 vs 3-2-1-1-0
Modern backup strategies often extend the traditional 3-2-1 rule into 3-2-1-1-0.
The additional requirements are:
3
Three copies of data.
2
Two different types of media.
1
One copy offsite.
1
One copy offline, air-gapped, or immutable.
0
Zero backup verification errors.
Example:
Common Mistakes
Keeping all backups in the same location
Having three backup copies in the same server room does not provide strong protection against a site-level disaster.
Using the same storage for everything
If production and backup depend on the same storage infrastructure, a storage failure can affect both.
Assuming RAID is a backup
RAID provides storage redundancy and availability. It does not replace a backup.
RAID ≠ Backup
Keeping only online backups
An attacker who gains access to the backup infrastructure may also attempt to delete or encrypt the backups.
This is why offline, air-gapped, or immutable copies are important.
Key Points
- 3 = Keep three copies of the data.
- 2 = Use two different types of storage media.
- 1 = Keep at least one copy offsite.
- RAID is not a replacement for backup.
- Backup copies should be protected from the same failures that can affect production.
- Offline, air-gapped, or immutable storage provides additional protection.
- 3-2-1-1-0 extends the traditional rule with stronger security and backup verification.
Conclusion
The 3-2-1 Backup Rule provides a simple foundation for designing a reliable backup strategy. It ensures that backup protection does not depend on a single server, storage system, or physical location.
Modern environments can extend this approach with immutable, air-gapped, or offline backups and regular backup verification, resulting in the 3-2-1-1-0 strategy.
A backup is only useful if it can still be recovered when the original data is gone. That's the mildly inconvenient truth behind the entire backup industry.
