The 3-2-1 backup rule has been an industry standard for decades: three copies on two different media, with one off site. Modern ransomware threats have shown the need to extend it to 3-2-1-1-0.
The new formula: 3-2-1-1-0
- 3 copies: production data plus two backups
- 2 different media, such as disk and tape or on-premises and cloud
- 1 off-site copy in a different geographic location
- 1 offline or immutable copy resistant to ransomware
- 0 verification errors, with regularly successful restore tests
Why does immutability matter?
Ninety-four percent of modern ransomware attacks target backups first. Immutable backups, such as S3 Object Lock or Veeam Hardened Repository, cannot be changed by an attacker. Without this layer, the chance of recovering from ransomware drops sharply.
An untested backup is not a reliable backup
Having a backup file and being able to restore it are different things. Perform a restore test at least quarterly and document the results. Around 30% of organizations that skip testing discover during a breach that they cannot recover.
Keep reading