What is the 3-2-1 backup rule?
Short answer
Keep three copies of important data, on two different types of storage, with one copy off-site. Against ransomware, also make sure at least one copy is offline or immutable, so an attacker with access to your network cannot delete or encrypt it.
The details
Backups only count if they restore. Test a restore of real files on a schedule, and know how long a full recovery would take. Protect backup admin accounts with MFA and separate credentials.
Terms explained
- Backup (3-2-1 rule)
- A backup is a separate copy of data that can be restored after deletion, failure or attack. The 3-2-1 rule means three copies, on two types of storage, with one off-site.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
- Ransomware
- Ransomware is malware that encrypts or steals data and demands payment to restore access or prevent publication.
Sources
Related questions
Related Guides
GuideIncident Response
How to Backup Data on Windows 11: A Step-by-Step Guide
Learn how to backup data on Windows 11 using built-in tools, external drives, and isolation practices to defend against hardware failure and ransomware.
Read more GuideSmall Business Security
How to Implement Ransomware Prevention in a Small Business
Learn practical ransomware prevention for small businesses. Protect devices, configure offline backups, secure access, and build an effective defense plan.
Read more GuideIncident Response
The Binance Hack Timeline: How a 93-Cent Transaction Drained $6.3 Billion
A minute-by-minute account of the October 2026 Binance hack: the EIP-7702 sweep, the freeze race, the "one laptop" explanation, the North Korea attribution and where the money is now.
Read more GuideAI Security
AI Agent Security: Implementing Least Privilege for Tools
Learn how to enforce least privilege for AI agent security. Control tool calling, scope data access, and prevent unauthorized actions in production.
Read more