The 3-2-1 Backup Rule Explained

01What 3-2-1 means

1. 01

   Three copies

   The live data plus two backups. One backup can fail; two failing at the same moment is far less likely.

2. 02

   Two types of storage

   For example a local backup device and cloud storage, so one hardware fault or software bug does not take out both.

3. 03

   One copy offsite

   Fire, flood, theft or a burst pipe can destroy everything in one building. A copy somewhere else survives it.

02Why ransomware changed the rule

Modern ransomware looks for backups first. If attackers reach the backup system with a stolen admin password, they delete or encrypt the backups before they encrypt everything else.

That is why the extended rule adds a copy that cannot be changed: offline, air-gapped, or immutable for a set period. CISA’s ransomware guidance recommends keeping offline, encrypted backups of critical data and testing them regularly.

03What to back up

• Servers, file shares and line-of-business databases
• Workstations that keep data on the local drive
• Microsoft 365: Exchange mail, OneDrive, SharePoint and Teams
• Cloud apps that hold client records, where an export or backup option exists
• Configuration for firewalls, switches and Wi-Fi

04Test restores, not just backups

A green checkmark on a backup job means the job ran. It does not prove the data can be restored, or how long that would take. Restore a few files regularly and a whole system on a schedule, and write down what you learn.

Testing also shows whether recovery fits the business, which is where RPO and RTO come in.

05How we help

With managed IT from ManagedITServices.Tech, each managed workstation includes 100 GB of managed backups. The backup and disaster recovery add-on extends that to a full plan: a local and offsite backup strategy, air-gapped or offline copies for ransomware resilience, backup monitoring and verification, a defined RPO and RTO, and quarterly or annual failover testing.

How managed backup works