What is the 3-2-1 backup rule?
The 3-2-1 backup rule is a best practice for protecting your data against loss. It states that you should always have at least 3 copies of your data, stored on 2 different media, with 1 copy located offsite.
Here’s what each part of the rule means:
-
3 copies – This means having the original data plus 2 backups. Having multiple backups protects you from hardware failures, accidental deletion, corruption, or ransomware.
-
2 different media – The backups should be stored on 2 different storage media. For example, you could have 1 copy on your computer’s hard drive, 1 copy on an external hard drive, and 1 copy on the cloud. Storing backups on different media protects against media failure.
-
1 copy offsite – 1 backup copy should be stored offsite or in the cloud. This protects against disasters like fires, floods, or theft that could destroy the backups stored locally. The offsite copy allows you to recover your data even if your local backups are compromised.
Why is the 3-2-1 rule important for disaster recovery?
The 3-2-1 rule is considered a best practice for disaster recovery because it reduces the risk of permanent data loss from disasters or hardware failure.
Disasters like fires, floods, earthquakes, or theft can destroy computer equipment and backup media stored onsite. Having an offsite backup copy ensures you can get your data back even if local copies are destroyed.
Hardware inevitably fails over time. Storing copies on different media protects against failure of any single storage device. And having 3 total copies guards against corruption or accidental deletion.
Without following the 3-2-1 rule, a single disaster, device failure, or human error could cause irrecoverable data loss. The 3-2-1 backup strategy provides layers of redundancy to minimize this risk and give you reliable options to recover from disasters.
Real world 3-2-1 backup examples
Here are some examples of how the 3-2-1 rule can be implemented in real world backup systems:
-
Local computer + external HDD + cloud storage: Store 1 copy on your computer, 1 copy on an external hard drive, and 1 copy in a cloud backup service like Backblaze or Dropbox.
-
On-premises NAS + offsite NAS + cloud storage: Use a NAS (network attached storage) onsite with a 2nd NAS at another physical location. Send 1 backup to the cloud.
-
Primary data center + DR site + cloud: For businesses, keep 1 copy at the primary data center, 1 copy at the disaster recovery site, and 1 copy in cloud storage.
-
Local server + external drive + tape backup: Back up a server to an external HDD and also write backups to tape media stored offsite. Send 1 backup to the cloud.
How frequently should you perform backups?
To maintain a resilient 3-2-1 backup system, it’s important to perform regular backup operations on each of the 3 copy locations.
For the onsite backups, most experts recommend doing incremental or differential backups daily to capture any changes. Onsite backup media should be replaced with fresh media every 2-4 years to avoid deterioration.
The offsite backup copy doesn’t need to be updated as frequently – most people back up to the cloud or offsite destination on a weekly or monthly basis.
Testing your ability to restore from backups regularly (e.g. annually) is also critical. You don’t want to discover at time of disaster that your backups are corrupt or unrecoverable. Periodic test restores help surface any issues.
Other disaster recovery best practices
While the 3-2-1 rule helps create resilient backups, there are other best practices to consider for complete disaster recovery protection:
-
Store backups encrypted – Encryption protects backups against unauthorized access if they fall into the wrong hands.
-
Keep offline backups – Maintain recent backup copies offline and disconnected to guard against ransomware.
-
Backup operating systems and software – Not just data! Critical to restore systems effectively.
-
Have an incident response plan – Document playbooks to follow in event of breach or disaster.
-
Test restoring from backups – Periodically demonstrate you can successfully restore to validate backups.
-
Keep backup copies in different geographic regions – Reduces exposure to region-specific disasters.
-
Maintain offsite inventories – Catalog equipment, software licenses, configs, etc. essential for recovery.
The 3-2-1 rule provides fundamental data loss protection. But taking a holistic approach to disaster recovery is key to maintain the resilience of your systems, data, and business operations.
