StarLabs Glossary / Cybersecurity & Network Terms
3-2-1 Backup Rule
A simple rule of thumb that keeps one bad day from wiping out your business data.
The 3-2-1 backup rule says you should keep three copies of important data, on two different types of storage, with one copy kept offsite. The idea is that no single failure, such as a dead drive, theft, fire or ransomware attack, can destroy every copy at once.
How it works
| Number | Meaning | Office example |
|---|---|---|
| 3 copies | The live data plus two backups | Files on the server, a nightly backup, and a cloud backup |
| 2 types of storage | Not all copies on the same kind of device | A NAS in the office and a cloud backup service |
| 1 offsite | At least one copy in a different location | A cloud backup, or a drive kept at another site |
The rule was created before ransomware became common, so many IT teams now talk about 3-2-1-1-0. The extra “1” is one copy that is immutable or offline, and the “0” means zero errors when you test a restore.
- Immutable backups cannot be changed or deleted for a set period, even by an administrator account. Many cloud backup services and some NAS systems offer this.
- Offline (air-gapped) backups are physically disconnected, such as a USB drive or tape that is unplugged and stored away after each backup.
This matters because modern ransomware actively hunts for backups. If your only backup is a drive that is always plugged in, or a NAS share mapped on every PC, it will probably be encrypted along with everything else.
Do not forget cloud apps. Microsoft 365 and Google Workspace keep your data available, but deleted or overwritten items are only recoverable for a limited time. A separate backup of mailboxes and shared drives is worth having.
What it means for your business
Start by listing the data you cannot run without: accounts, customer records, contracts, design files and email. Make sure each is covered by 3-2-1, with at least one immutable or offline copy, and test a restore regularly. CSA’s Cyber Essentials standard asks organisations to keep backups separate and offsite, protect them, and test them at least twice a year. StarLabs can design, set up and monitor backups for your servers, NAS, laptops and cloud accounts.
Common questions
Is OneDrive or Google Drive sync a backup?
Not on its own. Sync copies changes everywhere, including deletions and files encrypted by ransomware. Version history helps, but a separate backup is safer.
How often should we back up?
Ask how much work you could afford to lose. For most offices, daily backups of shared files and continuous backups of email are a sensible starting point. Busy systems may need hourly backups.
How do we know our backups work?
Test them. Restore a few files, and occasionally a whole system, to prove the backup is complete and see how long recovery takes.
When did you last test a restore?
StarLabs can check your backups against 3-2-1 and fix the gaps.
Sources: CSA Cyber Essentials (2025) document
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Cybersecurity & Network Terms · ← All terms · Common questions
