Definition
3-2-1 backup rule
In one sentence
3-2-1 backup rule is a data protection guideline that recommends keeping three copies of important data, on two different types of storage, with one copy stored offsite.
Immutable backupRecovery time objectiveRecovery point objective
3-2-1 Backup Rule Explained
The rule protects against different failure modes at once. Three copies mean a single corrupted backup is not fatal. Two storage types protect against a flaw affecting one technology. One offsite copy protects against fire, flood or theft at the main location.
Ransomware has prompted an update often called 3-2-1-1-0: add one copy that is immutable or offline, and aim for zero errors when testing restores. The extra copy matters because attackers with administrator access deliberately seek out and destroy connected backups.
For a Canadian SMB, a practical 3-2-1 setup might be the production data, a local backup appliance for fast restores, and an immutable cloud backup for disaster recovery, with Microsoft 365 data backed up separately. The plan should be matched to recovery objectives: how quickly each system must be back, and how much data loss is acceptable. Testing is the step most often skipped. A backup that has never been restored is an assumption, not a safeguard.
General information for Canadian organizations, not legal advice.