The 3-2-1 Backup Rule: What Each Number Means and How to Test It

What is the 3-2-1 backup rule?

The 3-2-1 backup rule is a simple way to make sure one bad day can’t take out every copy of your data. Keep 3 copies of any important file, store them on 2 different types of media, and keep 1 copy offsite. Here’s how the US-CERT Data Backup Options paper words it:

• 3: “Keep 3 copies of any important file: 1 primary and 2 backups.”
• 2: “Keep the files on 2 different media types to protect against different types of hazards.”
• 1: “Store 1 copy offsite (e.g., outside your home or business facility).”

That paper was written by Carnegie Mellon for US-CERT in 2012, and it footnotes the rule to Peter Krogh’s The DAM Book (2nd edition, 2009), a book on managing digital photo archives. So the rule came out of photography, not enterprise IT. It stuck because it’s easy to remember and hard to argue with. CISA’s Back Up Business Data page for small businesses still teaches it the same way today.

Why does each number exist?

Each number covers a different way to lose data. Three copies cover a single failure: a dead drive or a deleted folder still leaves two. Two media types cover a failure that hits one kind of storage at once. One offsite copy covers losing the building, whether that’s fire, flood, theft, or a burst pipe over the server closet.

The middle number is the one people fudge. Two backups on the same NAS, or two folders on the same server, are really one copy with extra steps. The US-CERT paper makes the point about backups kept on the same internal drive: if that drive is “damaged, stolen, or corrupted, you could lose both your primary and backup files.” “Different media” today usually means a local backup appliance or NAS plus cloud storage. CISA’s small-business page uses exactly that pairing as its example: “a hard drive and the cloud.”

What do CISA and NIST add to 3-2-1 now?

The 2012 rule was written for hardware failure and disasters. Ransomware changed what “offsite” has to mean. CISA’s #StopRansomware Guide (September 2023) says to “maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” It explains why: “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups.”

So the copy that’s offsite also needs to be out of reach. CISA gives two ways to do that:

• Offline. The backup is disconnected from the network, so nothing on the network can touch it.
• Immutable. The same guide notes that “some cloud vendors offer immutable storage solutions that can protect stored data without the need for a separate environment.” Immutable means the backup can’t be changed or deleted until its retention period runs out, even by an admin account.

NIST says the same thing in framework language. The Cybersecurity Framework 2.0 (February 2024) has one line for backups, PR.DS-11: “Backups of data are created, protected, maintained, and tested.” NIST’s NCCoE published a backup guide written for managed service providers that repeats 3-2-1 and adds a “go bag.” That’s a copy of critical data, passwords, and encryption keys kept “in a separate, secure and accessible location.” Your backups are only as good as your ability to log into them after a bad day.

Is OneDrive, Dropbox, or Google Drive a backup?

No. A sync folder keeps every device matching the same files. That’s the whole job. When a file gets deleted, the deletion syncs. When ransomware encrypts a file, the encrypted version syncs. The US-CERT paper warns about this with “rolling backups” that update automatically: they “can silently propagate any corruption or malware in the primary files to the backup files.”

Version history and the recycle bin help, and they’re worth turning on. Microsoft’s own Restore your OneDrive feature lets Microsoft 365 subscribers roll a OneDrive back after files were “deleted, overwritten, corrupted, or infected by malware.” But that window is the last 30 days, and it lives inside the same account an attacker may already control. Count your sync folder as the primary copy, then back it up somewhere separate.

What do regulators and insurers ask about backups?

They ask whether you can get the data back, not whether a backup job exists. The clearest written requirement for small regulated firms is HIPAA. The Security Rule at 45 CFR 164.308(a)(7)(ii)(A) makes a data backup plan Required: procedures “to create and maintain retrievable exact copies” of ePHI. Testing the contingency plan is an addressable spec under (a)(7)(ii)(D). We walk through how that shows up in a HIPAA risk assessment.

Cyber insurance questionnaires vary by carrier, but they commonly ask about tested backups right next to MFA, laptop encryption, and a device inventory. We keep that list on our cyber insurance compliance and backup page. The word that matters is tested. A green checkmark on a backup job doesn’t answer it.

How do you test a backup restore?

You test a backup by actually restoring from it and checking that what comes back is usable. CISA’s small-business guidance says to “test backup procedure to make sure your team can rapidly restore data both fully and partially.” It also says to make sure you can roll data back at least 7 days. A simple schedule for a small office:

1. Single-file restore, monthly. Pick a real file from last week, restore it to a different folder, and open it.
2. Point-in-time restore. Restore a folder as it was at least 7 days ago. That’s the test that tells you whether you could get past a ransomware event someone didn’t notice for a week.
3. Full-system restore, at least once a year. Bring a whole server or a critical PC back on spare hardware or a VM. NIST’s NCCoE guide lists what to time: retrieving files from offsite, restoring files, and rebuilding systems.
4. Restore from the offsite copy. Testing only the local copy doesn’t prove the cloud or offline copy works.
5. Write it down. Record the date, what you restored, where it came from, how long it took, and anything that broke.

Don’t forget the configuration that rebuilds the box. Our Proxmox host config backup report covers the part most backups miss: the network, cluster, and mount settings you need before the VM backups are any use. That script also refuses to run if the backup share isn’t mounted, so it can’t quietly write “backups” to the same disk it’s protecting.

Key takeaways

What this looks like when we do it

Every managed client we take on runs on 3-2-1. Backups run daily and automatically, the offsite copy is encrypted, and we can restore to a point in time. We test restores on a regular schedule and keep documented recovery procedures, because a backup nobody has restored is a guess. The details are on our compliance and backup service page.

When a carrier questionnaire or a HIPAA risk analysis asks about backups, the answer is already on file: the last restore test, what we restored, and how long it took.

Not sure when your backups were last restored? Book a call and we’ll check together.