The 3-2-1 backup rule, for servers
Three copies of your data, on two kinds of storage, one of them off-site. It is the simplest test of whether a backup plan survives a bad day, and most small server estates fail it somewhere.
- 3 copies
- The live data and two backups
- 2 kinds of storage
- So one fault can't reach every copy
- 1 off-site
- In a different place, account or provider
- +1 and 0
- One immutable copy; zero errors on test restores
Why three, two and one
Three copies, because one backup can fail without anyone knowing: a job that stopped running months ago, a file that won't restore. With two backups, both have to fail before the data is gone.
Two kinds of storage, because copies on the same kind of storage share the same weaknesses. Two disks in one server, or two snapshots on one cloud platform, can be lost to one fault, one bug or one bad command.
One off-site, because some disasters take the whole site: a data centre fire, a provider outage, or, far more often today, a lost or compromised account. The off-site copy is the one that is still there afterwards.
3-2-1 for a typical server estate
| Copy | Where | What it protects against | Good for |
|---|---|---|---|
| 1. The live data | The server or managed database | Nothing on its own; a replica adds protection from hardware failure | Running the service |
| 2. A fast local backup | Snapshots, or a backup volume, on the same platform | Mistakes, bad deploys and failed upgrades | Quick restores: minutes, not hours |
| 3. An off-site backup | A different provider or account, such as object storage elsewhere, encrypted | Losing the account, the provider or the region, and ransomware that reaches the first two | The restore you hope never to need |
3-2-1-1-0: the modern version
The original rule predates ransomware that hunts for backups. The newer form adds two numbers.
One copy offline or immutable. Immutable storage, such as object lock in S3-compatible storage, in compliance mode keeps each backup unchangeable until it expires, even if an attacker or a mistaken administrator has full access. (Governance mode can be overridden by users given that permission.) At the least, the server being backed up should be able to write new backups but not delete old ones.
Zero errors on test restores. A backup is only proven when it has been restored. Restore on a schedule, check the data and the application, time it, and fix anything that failed. The timed result is your real recovery time.
Where small estates usually fall short
Everything in one account. Snapshots and backup files in the same cloud account as the servers look like two copies, but one leaked key or one suspended account takes them all.
Backups the server can delete. If the backup credentials on the server can also delete backups, so can anyone who breaks in.
Databases copied as files. Copying a running database's data files often gives a backup that won't start. Use the database's own dump or backup tools, or snapshots it has been told about.
No alert when a backup stops. Backup jobs fail quietly. Something should complain when a backup is missing or smaller than usual, not just when one errors.
Never restored. The most common gap, and the one that matters most. A restore tested once a quarter catches every other problem on this list.
How I set it up for clients
- 01Map what needs backing up
Databases, uploaded files, configuration and secrets, with an RPO and RTO for each.
RTO and RPO calculator → - 02Build the three copies
Local snapshots for speed, an encrypted off-site copy with a different provider, and object lock so the server can add but not delete.
- 03Watch them and test them
An alert when a backup is late or looks wrong, and a timed restore every quarter, written up for your records.
GUARD review → - 04Write down the recovery
Who decides, what comes back first, and the restore steps, in a plan and a runbook per server.
Free disaster recovery plan template →
Questions
What is the 3-2-1 backup rule?
Keep three copies of your data (the live copy and two backups), on two different kinds of storage, with one copy off-site. It means no single failure, mistake or attack can take every copy at once.
What is the 3-2-1-1-0 rule?
The 3-2-1 rule with two additions: one copy that is offline or immutable (it cannot be changed or deleted, even by an administrator, until it expires), and zero errors when the backups are test-restored.
Does the cloud count as off-site?
Yes, if it is separate from where the live data is. A backup in the same cloud account as the server is not really off-site: losing the account, or an attacker with its keys, takes both. Use a different account, a different provider, or both.
Are snapshots backups?
They are one copy, usually on the same platform as the server. They are quick to restore from, which makes them good for the first copy, but they do not meet the off-site or offline parts of the rule on their own.
Is RAID or a replica a backup?
No. RAID and replicas copy every change instantly, including deletions, corruption and ransomware encryption. They keep the service running when hardware fails; backups get the data back after a mistake.
How often should backups be tested?
Restore at least one system every quarter, and after any big change. Time each test and write down the result: it is the evidence auditors and customers ask for, and the only way to know your recovery time.
Would your backups pass 3-2-1?
The £250 GUARD review checks where every copy is, who can delete it, and whether it restores. Book a call to start.