What Is the 3-2-1 Backup Rule? An Implementation Guide for the Ransomware Era
The 3-2-1 rule works like this: keep 3 copies of the data. Store the copies on 2 different media. Keep 1 copy away from the main site. The rule prevents one failure from destroying every copy.
A backup rule: keep 3 copies of data, on 2 different media, with 1 copy at a different location.
Why Does It Matter?
A single backup is a single point of failure. Ransomware can encrypt backups on the same network. A different medium and a different location reduce this risk.
Core Principles & How It Works
What Threats Arise from Inadequate Protection?
- ✕All three copies sit on the same network share.
- ✕The offsite copy can be deleted with a Domain Admin account.
How Does Moftgate Solve This Challenge?
In modern practice, the rule is extended so that one copy is immutable. The Moftgate WORM-locked backup approach fits this principle.
Related Guides and Articles
- Immutable (WORM) Backup Guide: 6 Steps to Ransomware-Ready Recovery →
How do you plan, build and verify an immutable backup? A step-by-step guide to the 3-2-1 rule, RPO/RTO targets, lock mode choice and restore testing.
- Attackers Now Target Your Backups: Why Immutable WORM Storage Matters →
Ransomware attackers look for backups before they encrypt. Why do ordinary network-share backups fail, and how does WORM-locked storage protect recovery after an attack?
Other Cybersecurity Terms
Full Glossary →A storage model where data is written once and cannot be changed or deleted for a set retention period.
A backup copy that cannot be changed or deleted during its retention period.
RPO is the acceptable amount of data loss in time. RTO is the maximum time accepted to restore a service.
Build Your 3-2-1 Backup Rule Strategy with Moftgate
Connect with our enterprise engineering team for architecture reviews and live demonstrations.