# What is the 3-2-1 backup rule?

It is a simple rule for surviving the loss of any one thing: keep three copies of your data, on two different types of storage, with one copy off-site. The original plus two backups, for example one on a local backup appliance and one in a separate cloud or at another location, means that a fire, a failed disk array or a stolen server does not take everything. Because ransomware attackers now look for backups and try to delete them, many guides extend the rule to 3-2-1-1-0: one copy that is offline or immutable, so that it cannot be changed or deleted even with administrator rights, and zero errors when the backups are verified and test-restored. For a small company, a practical version is a local backup for fast restores, an immutable cloud copy under separate credentials, and a regular, documented restore test.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/what-is-the-3-2-1-backup-rule

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is an immutable backup?](https://netsenx.com/en/faq/what-is-an-immutable-backup)
- [What is an offline or air-gapped backup?](https://netsenx.com/en/faq/what-is-an-offline-or-air-gapped-backup)
- [How often should we test a restore?](https://netsenx.com/en/faq/how-often-should-we-test-a-restore)
- [Do ransomware gangs go after backups first?](https://netsenx.com/en/faq/do-ransomware-gangs-go-after-backups-first)
- [Why is a backup mapped as a network drive a risk?](https://netsenx.com/en/faq/why-is-a-backup-mapped-as-a-network-drive-a-risk)