The 3-2-1 rule is the gold standard of backups and it fits in a single sentence: three copies of your data, on two different media, with at least one off-site. It was born in professional photography more than two decades ago and today every cybersecurity agency in the world recommends it, because it remains the simplest way to survive almost any disaster.
What is interesting is not the rule itself, but understanding why each number is there. Each one tackles a different risk, and dropping any of the three leaves you exposed to a specific scenario.
The three: surviving simple failure
Three copies means the original plus two additional copies. It can look excessive until you run the numbers: if the probability of one medium failing at a given moment is one percent, with two copies the probability of losing both at once drops to 0.01 percent.
But hardware failure is not the main enemy. The most frequent enemy is human: someone deletes a folder, overwrites a file, or runs a script that wipes a database table. With only one copy, if the deletion happened before the last sync, you already lost the data in both places.
The two: keeping one defect from taking everything
Two different media protects against correlated failures. Two drives of the same model bought on the same day have a surprisingly high chance of failing around the same time, because they share a manufacturing batch, running hours and thermal conditions.
The same applies to software errors. If your backup depends on the same file system or the same software as the original, a fault in that software can corrupt both. Changing technology between original and copy breaks that chain.
The case of the permanently plugged USB drive
This is the most common mistake in small businesses, and it deserves to be named plainly: a USB drive permanently connected to the same server is not a separate backup. It is in the same building, on the same power circuit, exposed to the same surge, and above all reachable from the same operating system. If ransomware gets into that server, it will encrypt that drive too, because to it that is simply another folder.
The one: the copy that really saves you
The off-site copy covers disasters that affect an entire location: fire, flood, theft, or an attack spreading across your whole local network. It is the most inconvenient to maintain and the one most people skip, and precisely for that reason it is the one that most often makes the difference between a scare and a company closing.
To count as a genuine off-site copy it must meet two conditions. The first is obvious: physically in another building. The second is the one almost nobody considers: your systems must not be able to modify it. If your server holds credentials to write to the remote destination, an attacker who controls your server holds them too.
The modern version: 3-2-1-1-0
The rule has evolved to answer ransomware. The extended version adds two conditions:
- One immutable or offline copy that cannot be altered or deleted for a set period.
- Zero errors in verification, which means actively checking backup integrity instead of assuming it is fine.
That zero is the one usually missing. A corrupt backup takes up the same space as a good one and gives no warning until the day you need it.
How this applies in a real small business
You do not need an enterprise budget. A perfectly valid scheme for a small business would be: production data, a local copy on a NAS separate from the server, and a remote copy at an external provider. Three copies, two technologies, one off-site.
What you do need is honesty when auditing it. Take a piece of paper and answer: how many copies do I actually have right now? Are they on different media or all in the same cabinet? Is the off-site copy truly unreachable from my servers? When did I last restore something for real?
That last question is usually the one that leaves the room silent.
Our approach
Our backup services in Andorra follow the rule for you: two data centres of our own, we always open the connection with read-only credentials so your servers can never write over the history, and every year we run a real restore test that we hand you signed. That is the zero of the extended rule, turned into a document.
If your infrastructure lives on a VPS, the daily backup addon sets the scheme up for you without any administration on your side.