Guide · Backup strategy
The 3-2-1-1-0 rule explained simply
In short: keep three copies of your data on two different media, one of them off-site and one immutable – and check that all of them can be restored without errors. The rule extends the well-known 3-2-1 rule, which Germany's Federal Office for Information Security (BSI) also recommends, with protection against ransomware and a tested restore.
The five digits
| Digit | Meaning | What it protects against |
|---|---|---|
| 3 copies | The original data and at least two backups | Failure of a single backup |
| 2 media | At least two different kinds of storage, such as disks in the server and a NAS or backup server | Faults that affect a whole class of device |
| 1 off-site | One copy at a different location | Fire, water, theft, power surges |
| 1 immutable | One copy offline or locked against changes and deletion | Ransomware and attackers with administrator rights |
| 0 errors | Tested and restorable | Backups that do not work when they are needed |
Why 3-2-1 is no longer enough
The 3-2-1 rule dates from a time when hardware faults and accidents were the biggest risks. Today attackers go after the backups on purpose: before ransomware encrypts the data, it deletes or encrypts every backup it can reach. An off-site copy only helps if the attacker cannot delete it with the same credentials. Hence the additional 1 for an immutable copy.
The 0 reflects the experience of many emergencies: backups that had been reported as “successful” for years could not be restored – because a disk was missing, a service did not start or the key had been lost. Only a test shows whether a backup is any good.
An example from practice
A company with a Hyper-V host, a file server and Microsoft 365 implements the rule like this:
- Copy 1: every night to a NAS in the server room – for quick everyday restores.
- Copy 2: in the same run to a backup server with a WORM lock in another fire compartment or at a second site – immutable for 30 days.
- Off-site: the backup server mirrors at night to a second backup server off-site or to cloud storage in Germany; in addition, a weekly export to a USB disk that is kept in a safe.
- Zero errors: every Saturday three randomly chosen backups are restored as a test, their file systems checked and the VMs started in an isolated environment.
All of this is recorded in the backup plan – together with retention, responsibilities and where the key is kept.
The most common mistake: several runs instead of one
Many environments meet the rule with several separate backups – one local, a second to the cloud, later a copy job. That costs time in the backup window, puts load on the systems several times and leads to copies with different states. Better is one run that reads the source once and writes to all destinations at the same time.
How AegisGrid implements the rule
AegisGrid reads the source once and writes to up to eight destinations in one run: USB disk, NAS, an on-site backup server with a WORM lock, an off-site backup server or the cloud storage. Each destination only receives what it is still missing. For the 0, the backup server checks all stored data and automatically restores backups as a test. Every copy on a backup server, every check and every check restore is recorded in the signed evidence log.
Frequently asked questions about the 3-2-1-1-0 rule
Does the cloud count as “off-site”?
Yes, if the copy is in a different building and cannot be deleted with the same credentials as the local backups. A second site of your own meets the requirement just as well.
Is a USB disk enough as the immutable copy?
Yes, as long as it is disconnected after the backup and stored safely – then no attacker can reach it. More convenient is WORM storage, which automatically locks backups against deletion until a fixed date.
Is the 3-2-1-1-0 rule a legal requirement?
No, it is a proven recommendation from practice. Laws such as NIS2 and the GDPR require working backup and recovery; the rule is a good way to achieve that. More on this in the article NIS2 and backup.
3-2-1-1-0 in one run
In a pilot project we implement the rule with you on your own systems.