Backup and Disaster Recovery: The 3-2-1 Rule Explained

The 3-2-1 rule

The 3-2-1 rule is a simple, battle-tested way to think about backups:

• 3 copies of your data
• 2 different types of storage (for example, a local device and the cloud)
• 1 copy kept off-site

If any single thing fails, a fire, a failed drive, ransomware, you still have a clean copy somewhere else.

Why backups fail when you need them

The most common backup problem is not the absence of a backup. It is a backup that was never tested. Drives fill up, jobs quietly stop running, or the copy turns out to be corrupted, and nobody finds out until the day they need it.

• Backups that stopped weeks ago with no alert
• Copies stored on the same network ransomware would reach
• Nobody has ever actually restored from them to check they work

Backup versus disaster recovery

A backup is a copy of your data. Disaster recovery is the plan for getting your business running again after something goes wrong. They are related but not the same.

Two numbers make the plan concrete: your recovery point objective (how much data you can afford to lose, measured in time) and your recovery time objective (how quickly you need to be back up). Agreeing on those up front tells you how much backup and recovery you actually need.

The part people skip: testing

A backup you have never restored is a hope, not a plan. Testing a recovery on a schedule is the only way to know it will work when it counts.