3-2-1 Backup Rule

The 3-2-1 backup rule is a practical approach to reducing the risk that one incident destroys every usable copy of important data. It recommends keeping three copies in total: the primary data plus two backups, stored on at least two different kinds of media, with at least one copy offsite. The rule is a starting point for resilience rather than a guarantee against ransomware, accidents or account compromise.

A small service business may need to protect booking records, website files, financial documents and customer communications. The offsite copy should remain accessible during a local outage, and backup credentials should be safeguarded separately where practical. An online synchronized folder is not always a complete backup because accidental deletion or corruption may synchronize too.

Backups must be restored in tests, not just scheduled. Teams should also define how recently data must be recoverable and how fast operations must resume. Those requirements link the 3-2-1 rule to Recovery Point Objective (RPO) and Recovery Time Objective (RTO), which are separate concepts.