"We have backups" is one of the most common things we hear in an initial conversation, and one of the most common things that turns out to be only partially true once we actually check. The 3-2-1 rule is a simple structure that catches most of the ways backup strategies quietly fail.
What the rule actually says
- Keep at least 3 copies of your data (the original plus two backups)
- Store those copies on at least 2 different types of media or systems
- Keep at least 1 copy offsite, physically or logically separate from the rest
Why "different media" matters
If your only backup lives on a network-attached drive connected to the same network as your production systems, ransomware that spreads across that network can encrypt the backup right along with everything else. A backup that’s reachable from the same compromised environment isn’t meaningfully separate from what it’s backing up.
Why offsite (or immutable) matters specifically against ransomware
An offsite copy, or an immutable cloud backup that can’t be altered or deleted even by an account with admin credentials, is what actually survives a ransomware incident where an attacker has full network access and is deliberately trying to destroy backups before deploying the encryption payload — which modern ransomware operators routinely do.
The step almost everyone skips
None of this matters if the backup has never actually been restored. We’ve seen backups that had been running successfully for years turn out to be silently corrupted, or missing a critical database, the first time anyone actually tried to use them. Scheduled restore testing is the part of a backup strategy that gets skipped most often, and it’s the part that determines whether your backup is real or theoretical.