The 3-2-1 backup rule, explained simply

Most backup strategies don't fail because they lack technology. They fail because they only protect against one scenario, a broken hard drive say, but not fire, theft, or a ransomware attack that encrypts everything including the backup.

The rule

3 copies of your data in total (the original plus two backups). 2 different types of storage media, an external hard drive and cloud storage for example, not two disks of the same kind in the same machine. 1 copy kept at a different physical location than the original.

Why that specific combination

Two copies on the same media, two disks in the same computer for example, protects against almost nothing. If the power supply fails, it often takes both with it. Two copies in the same location don't protect against fire or a break-in. The physically separate copy is the one that saves you when everything else at the office is gone.

What this looks like in practice for a small company

• The original: the files on the server or in the cloud service you work in daily.
• Copy 1: automatic backup to an external hard drive or NAS at the office.
• Copy 2: automatic backup to a cloud service, physically located somewhere else entirely.

Test the restore at least once a quarter. A backup nobody has tested restoring is just a hope, not a backup.