What Is the 3-2-1 Backup Rule?
Definition
The 3-2-1 backup rule says to keep three copies of important data, on two different types of storage, with one copy off-site. A backup is a separate copy of data you can restore after a cyberattack, accidental deletion, hardware failure, or disaster. The rule exists so one event cannot destroy every copy at once.
How It Works
CISA's small business guidance, Back Up Business Data, states the rule plainly: "3 copies of important files, 2 different types of storage media (like a hard drive and the cloud), 1 copy stored off-site, away from your business location." It adds the practices that make backups usable:
- Automate. Choose a backup that "runs automatically and regularly."
- Protect the copies. Use physical security, encryption, and offline copies.
- Test restores. Make sure your team can restore data "both fully and partially," and can "roll back data at least seven days if needed."
- Write it down and train people. A backup plan only helps if staff know how to use it.
Ransomware has changed what "off-site" needs to mean. A cloud sync folder or a backup drive that stays connected can be encrypted or deleted along with everything else. Joint FBI and CISA ransomware advisories, such as the 2023 CL0P advisory, call for backups that are offline, and backup data that is encrypted and immutable, meaning it cannot be altered or deleted. The rule still works; at least one of the three copies has to be out of the attacker's reach.
Real-World Example
The joint #StopRansomware advisory on Akira ransomware (AA24-109A, updated November 13, 2025) from the FBI, CISA, and international partners describes attackers going after backups directly. Akira actors exploited vulnerabilities in unpatched Veeam Backup and Replication servers, and their encryptor uses PowerShell commands to delete Windows Volume Shadow Copies, the built-in restore points many small offices rely on. The advisory reports that Akira had claimed about $244.17 million in ransom proceeds as of late September 2025. Its first mitigation: "Maintain regular backups of critical data, ensure backups are stored offline, and regularly test the restoration process."
Why It Matters for a Small Business
Verizon's 2026 Data Breach Investigations Report found that, among ransomware cases where the victim's size was known, about 96% of victims were small and medium businesses. For those businesses, a tested, offline backup is the difference between restoring and negotiating. It also protects against problems that have nothing to do with criminals: a failed drive, a bad update, or an employee who deletes the wrong folder. CISA calls backups "your best hope of recovery from a ransomware attack." The same Verizon analysis found these victims were typically hit through compromised credentials (38%) or unpatched edge devices (29%), so a business can do many things right and still need its backups.
How to Spot It / How DTS Handles It
Warning signs: every copy is reachable from the office network, backups use the same admin login as everything else, nobody has done a test restore this year, and nobody can say how far back the oldest good copy goes.
DTS can help with designing 3-2-1 backups with an offline or immutable copy, monitoring every job, and running scheduled test restores. See our data recovery service.
Related Terms
- Recovery point objective (RPO): how often backups must run.
- Recovery time objective (RTO): how fast restores must finish.
- Immutable backup: a copy that cannot be changed or deleted.
- Ransomware: the attack that targets backups first.
- Recovery: the incident response stage backups make possible.
- Snapshot vs backup: why a hosting snapshot is not a full backup plan.
Sources
- CISA, Back Up Business Data: https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/back-up-business-data
- FBI, CISA, et al., #StopRansomware: Akira Ransomware (AA24-109A, updated November 13, 2025): https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
- FBI and CISA, #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
- Verizon, 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/Tf3/reports/2026-dbir-data-breach-investigations-report.pdf
Last updated October 14, 2026.