Sooner or later it happens to everyone: a drive that stops spinning, a file deleted by mistake, a phone dropped in water, a business frozen by a cyberattack. In those moments the question is always the same: “Is there a copy somewhere?” The 3-2-1 rule is the simplest, most proven answer to that question. It isn’t a product or a technology: it’s a way of thinking about backups that works just as well for a photographer with their photos as for a company with its business software.

The starting point is an uncomfortable but healthy idea: sooner or later something will be lost. That’s not pessimism, it’s statistics. Drives fail, people make mistakes, software has bugs, thieves exist. A backup isn’t there to stop that from happening. It’s there to make sure that when it does, it isn’t a disaster.

What the 3-2-1 rule says

The rule boils down to three numbers.

• 3 copies of your data. The original plus two more copies. “Having a backup” isn’t enough: you want at least two, on top of the data you use every day.
• 2 different media. The copies shouldn’t all sit on the same kind of device. For example: your computer’s drive and an external disk, or a local disk and a cloud service.
• 1 copy offsite. At least one copy should live in a physically different place: another building, a data center, the cloud. Away from the risks that threaten the original.

Put like that, it sounds obvious. The value is in why each of those numbers is there.

Why three copies and not one

A single backup, kept right next to the original, protects against very little. If I delete a file by mistake and notice right away, fine. But if the backup lives on the same disk as the original, one drive failure takes both at once. If it’s in the same room, a theft or a flood does the same.

Three copies make it unlikely that a single event wipes out all of them. It’s the same reason you don’t keep all your cash in one place. The more independent the copies are from one another - that’s what engineers call redundancy - the less likely you are to lose them together.

Why two different media

Every kind of storage has its own weak spots. A mechanical drive can wear out and break. A USB stick can be lost. An online service can have an outage or an account problem. Using two different types of media keeps the same flaw from hitting every copy.

A classic example: one copy on an external disk in the office and one copy in a cloud service. The two media share almost no risks. The lightning strike that fries the electronics in the office doesn’t touch the cloud; the connection problem that blocks the cloud doesn’t stop you reading the external disk.

Why one copy offsite

The first two rules protect against failures. The third protects against disasters that hit an entire place: a fire, a flood, a theft - but also a cyberattack that encrypts or wipes everything it can reach over the network.

“Offsite” means exactly that: a copy that isn’t in the same place as the rest of your data and, ideally, can’t be reached with the same credentials, a requirement that squarely falls under the security measures required under GDPR on the infrastructure side. If a fire destroys the office, the copy in a data center on the other side of the country is still there. If an attacker gets into the systems, a copy that’s isolated and can’t be changed is the last line of defense, the same principle behind encryption keys that not even the cloud provider can read without the customer’s consent.

The backup nobody tests

There’s a mistake that shows up again and again: taking backups for years and never actually trying to bring them back. A backup that has never been restored isn’t a backup - it’s a hope.

The reasons a restore can fail are many and mundane. The backup file is corrupt. The job, maybe scheduled with a timer, was saving the wrong folder. The password to open the encrypted archive is gone. The format isn’t readable anymore. All things you only find out by trying - and the worst time to find out is during a real emergency.

That’s why the restore test is part of the rule, not an extra. Restoring a copy every so often into a separate environment and checking that the data is really there is the only way to know the backup works. If it hasn’t been tested, you don’t know it works: you’re hoping. It’s also the first requirement of any major infrastructure change, such as upgrading a Proxmox hypervisor that is leaving support: before touching the server, you make sure the way back actually exists.

RPO and RTO in plain words

When people talk about serious backups, two acronyms show up: RPO and RTO. They sound complicated, but behind them are two very concrete questions.

RPO stands for Recovery Point Objective. It answers the question: “How much data can I afford to lose?” In practice it’s how often you take a backup. If I save once a day, in the worst case I can lose up to a day’s work: everything that changed since the last backup. If that’s too much, the answer is to back up more often. NIST - the U.S. body that publishes technical standards - defines it as the point in time to which data must be recovered after an outage.

RTO stands for Recovery Time Objective. It answers the other question: “How long can I stay down?” It’s how much time can pass between the failure and getting back to normal. A personal site can be down for a few hours without much harm; an online shop during a sale weekend cannot, not too different from the reasoning behind choosing a highly available database for the most critical services. NIST describes it as the overall length of time systems can be in recovery before the impact on the organization becomes unacceptable.

The two acronyms measure two different losses: RPO measures lost data, RTO measures lost time. Deciding them in advance helps you choose: how often to back up, and how quickly you need to be able to restore. Everything else follows from there.

Where the rule comes from

The “3-2-1” formula was popularized by photographer Peter Krogh in the mid-2000s, in his book The DAM Book on managing digital archives. Krogh didn’t invent the idea of multiple copies and an offsite copy - it already existed - but he distilled it into three easy-to-remember numbers. Since then it has become a common reference, echoed even by public agencies that deal with cybersecurity.

It’s not a dogma

3-2-1 is a good starting point, not a finish line. In recent years, as ransomware attacks have spread - the programs that encrypt your data and demand a ransom - variants have emerged that stress two extra points: keep at least one copy that is immutable or air-gapped from the network, so an attacker can’t delete it, and verify that restores run without errors. These are refinements, not upheavals: the core stays the same.

The reverse is true too. Home data doesn’t need a corporate plan: two copies on different media and one in the cloud already cover most of the risks. The rule scales up and down.

In summary

The 3-2-1 rule works because it attacks the right problem: not “how to avoid failures” but “how to survive when they happen.” Three copies make it unlikely you lose them all at once; two different media keep the same flaw from hitting all of them; one offsite copy survives the disasters that erase a whole place. And none of it counts if you never try to restore. Defining how much you can lose (RPO) and how long you can be down (RTO) turns a good habit into a plan. You don’t need to be an expert - you just need to take seriously the idea that, sooner or later, a copy will actually be needed.

Sources

• NIST - Recovery Point Objective (CSRC glossary)
• NIST - Recovery Time Objective (CSRC glossary)
• Wikipedia - Backup (the 3-2-1 rule)
• Backup Wrap-Up - Peter Krogh and the origin of the 3-2-1 rule