3-2-1 Backup Rule Explained (And Why It Actually Works)

Three copies, two media types, one offsite. It sounds like a marketing slogan. It isn't. It's the minimum bar for surviving the three most common failure modes: hardware death, ransomware, and human error. Here's why each number matters and what people get wrong.

The 3-2-1 rule is old. It predates the cloud. It predates most of what you think of as modern IT. And it still works, because the failure modes haven't changed much.

Three copies means your production data plus two backups. Not one backup. Two. The second backup exists because your first backup will, at some point, be corrupted, deleted, or encrypted by the same event that took out production.

Two different media types means you don't keep both backups on the same device class. If your NAS firmware has a bug, both copies on that NAS go down together. Mix it up: SSD, spinning disk, cloud object storage. Different vendors, ideally.

One offsite copy is the one people skip. It's also the one that saves you when the building burns down, floods, or gets hit with a ransomware incident that spreads across your LAN.

What people get wrong: treating sync as backup. Dropbox, OneDrive, and SharePoint are not backups. They replicate deletes. If ransomware encrypts the file, the encrypted version syncs. You need versioned, immutable snapshots.