The 3-2-1 backup rule, explained for 2026

What the rule says

The 3-2-1 rule is the oldest rule of thumb in backup, and still the best place to start:

• 3 copies of your data: the original plus two backups.
• 2 different kinds of storage: for example a local disk or NAS and object storage at an external party.
• 1 copy offsite, at a different physical location than your servers.

The logic is simple: one copy can break, one kind of storage can share a common defect (same firmware, same power surge), and one building can burn down or flood. Three independent ways to fail, three independent protections.

What changed since 2010

The rule dates from a time when the biggest threat was a broken disk. Today it is ransomware, and ransomware has learned something: it looks for your backups first. A NAS mounted as a network drive, a backup server with domain rights, a cloud bucket whose key sits on the server: all of those are "copies" that get encrypted or wiped along with the rest.

That is why people now speak of 3-2-1-1-0:

• the extra 1: one copy is immutable or offline. Nobody can delete or overwrite it during the retention period, not even an administrator with the right password.
• the 0: zero errors when testing the restore. A backup that has never been restored is a hope.

What "immutable" means in practice

With object storage (S3 and compatible) this is called object lock in compliance mode. Every version of every object gets an expiry date, and until that date deletion is impossible: not for your IT person, not for the attacker with their password, not for the storage provider itself. A deletion during the period is only a marker; the real data stays.

That is different from "versioning" or "recycle bin". Those can be emptied by an administrator. A compliance lock cannot.

3-2-1 in a small business, step by step

1. Take inventory of what really matters: databases (accounting, ERP, web shop), file servers, mailboxes, server configuration. Do not forget Microsoft 365 or Google Workspace; that is your data, not Microsoft's.
2. Choose the offsite copy first. Object storage in Europe, with object lock, at a provider that does not charge for outbound traffic, so that restoring does not produce an invoice. Zekura uses Cubixion in Antwerp by default.
3. Separate the rights. The software that makes backups may only append. Pruning happens elsewhere, with a different key. If your current tool cannot do that, that is a reason to switch.
4. Encrypt before it leaves. The key stays with you. That way the second and third copy are not a data breach either if the storage is ever compromised.
5. Decide on retention. Thirty days undeletable is a good baseline; those with DORA or strict NIS2 requirements choose longer and a second location.
6. Test the restore, and measure. Not once, but automatically and regularly. Note how long it takes: that is your real recovery time.

What Zekura automates

Zekura is built around 3-2-1-1-0. The agent on your server encrypts and sends to immutable object storage in Belgium, optionally with a second EU location. The agent cannot delete anything; pruning is done by a separate worker, and even that one cannot get under the lock period. And the zero errors: every night every backup is read back on a separate machine, every day a sample is compared with the source, every week a database is fully restored and counted. The result goes into an evidence chain your auditor can recompute independently.

Frequently asked questions

Does a second hard disk in the same server count as a second copy?

No. Same server, same power, same intruder. A copy that shares the fate of the original is not a copy.

Is the cloud my offsite copy?

Only if it is a backup, not a sync. OneDrive or Dropbox synchronise an encrypted file just as faithfully as a healthy one. An offsite copy is a separate, immutable snapshot of an earlier moment.

How often should I test?

More often than you think is feasible, and therefore automatically. A yearly recovery exercise is the minimum for the auditor; a daily automatic trial restore is what lets you sleep.

Is 3-2-1 enough for NIS2?

3-2-1 is the technique; NIS2 also asks for policy, testing and proof. Read the guide on NIS2 and backup.