3-2-1 Backup Rule

What Is the 3-2-1 Backup Rule?

The 3-2-1 backup rule is a data protection strategy that says you should keep three copies of your data, on two different types of storage media, with one copy stored offsite. It is the most widely recommended backup standard because it protects your data against nearly any single point of failure, from hardware crashes to ransomware to physical disasters.

How It Works

The rule breaks down into three simple parts. Three copies means your original data plus two backups, so no single failure wipes out everything. Two different media types means storing those copies on different kinds of storage, such as a local drive and cloud storage, so one type of failure does not destroy all copies at once. One offsite copy means keeping at least one backup in a separate physical location or in the cloud, protecting you against fire, theft, or a local disaster.

The strength of the rule is its simplicity. If a server fails, you have another copy. If a local backup is destroyed, your offsite copy survives. If ransomware encrypts your systems, a properly isolated offsite backup lets you recover without paying.

Modern versions sometimes extend the rule to 3-2-1-1-0, adding one immutable or air-gapped copy and zero errors after backup testing, which strengthens protection against ransomware specifically.

Why It Matters

Backups that have never been tested may not actually work, and a single backup stored in one place is a single point of failure. The 3-2-1 rule matters because it removes that fragility. For clinics, nonprofits, and small businesses, it is the difference between a minor disruption and a catastrophic, unrecoverable data loss.

Related Terms

• What Is Ransomware?
• What Is Backup and Disaster Recovery (BDR)?
• What Are RTO and RPO?
• What Is a Business Continuity Plan (BCP)?

For a complete guide, read our full article on backups that actually work for small healthcare and nonprofit organizations.

SecTec implements 3-2-1 backup strategies with tested, encrypted recovery as part of our disaster recovery and backup service.