The 3-2-1 backup rule says keep three copies of your data, on two different types of storage, with one copy off-site. It is the minimum standard for surviving hardware failure, ransomware, theft, fire and human error without losing the business.
What each number means
- 3 copies — the live data plus two backups. If one backup is corrupt or mid-overwrite when you need it, you still have another
- 2 media types — for example an on-site backup appliance and cloud storage, so a single failure mode (a dead NAS, a cloud account lockout) does not take out every copy
- 1 off-site — a copy that is not in the building, so a fire, flood or theft does not destroy your data and your backup together
Why Microsoft 365 and Google Workspace are not a backup
Microsoft and Google keep your service running and protect against their own infrastructure failures. They do not protect you from a user deleting a mailbox, a compromised account wiping files, or a retention policy aging data out. Once their limited recovery window passes, the data is gone. If 365 is your only copy, your backup count is effectively zero — add a third-party backup of 365 to a separate location. This is covered in our cloud services and backup and disaster recovery work.
A modern take: 3-2-1-1-0
- 1 more — one copy offline or immutable, so ransomware cannot reach and encrypt it
- 0 errors — every backup verified by a test restore, not just a green tick in a dashboard
Making it real
Backups only count if you have restored from them recently. Set RTO and RPO targets, run a real restore on a schedule, and check that the off-site and immutable copies are actually populating.
Not sure your backups meet 3-2-1? See our backup and disaster recovery service or ask our Edmonton team for a check.
Frequently asked questions
Is cloud storage alone enough?
No. One cloud copy is one copy. You still need a second copy on different media and protection against your own account being compromised or a sync deleting good data.
Do I need a physical backup device if I use the cloud?
A local copy makes fast restores possible and covers you if internet or the cloud provider is unavailable. Many small businesses run a local appliance plus cloud, which satisfies 3-2-1 on its own.
How often should backups run?
As often as your RPO requires. Nightly is a common baseline; systems with low tolerance for data loss need hourly or continuous protection.
How does Scandifix help?
We set up 3-2-1 (or 3-2-1-1-0) backups including a third-party backup of Microsoft 365, monitor that every copy is current, and test restores. See our backup and disaster recovery service.