3-2-1 backup rule

The 3-2-1 rule is the long-standing rule of thumb for backups, recommended by agencies including CISA. You keep three copies of important data (the live copy plus two backups), on two different types of storage (for example, a local backup device and cloud storage), with one copy somewhere physically separate from your office.

Each number protects against a different failure. Three copies means one bad backup doesn’t sink you. Two kinds of storage means a single type of failure — a dead disk model, a cloud account problem — can’t take out everything. The off-site copy protects against fire, theft, flooding or a hurricane that damages the building. For Florida businesses, that last one isn’t theoretical.

Many providers now talk about 3-2-1-1-0: add one copy that is offline or immutable, so ransomware can’t encrypt or delete it, and zero errors when you test a restore. Ransomware attackers deliberately hunt for backups connected to your network, so a copy they can’t reach is what lets you recover without paying.

Example: a dental office keeps its practice database on a local server. Hourly snapshots go to a backup appliance in the office (copy two, different hardware) and a nightly copy goes to encrypted cloud storage with deletion protection (copy three, off site, immutable). When a server disk fails, they restore from the local appliance in an hour; if the building were flooded, they’d restore from the cloud. Work out your space needs with the backup storage calculator, and read the backup and disaster recovery guide for the full picture.