The Right Backup Strategy:
The 3-2-1-1 Rule Explained
6 min read · By Vantyk Team
Every business owner believes their data is safe — until it isn't. Hardware fails, ransomware encrypts entire systems overnight, employees accidentally delete critical files. The question isn't whether a data loss event will happen to your business. It's whether you'll be able to recover when it does. The 3-2-1-1 rule is the backup strategy that ensures you can.
What Is the 3-2-1-1 Rule?
The original 3-2-1 rule was developed by photographer Peter Krogh and later adopted by the US-CERT as a data protection standard. The additional "1" was added in response to the rise of ransomware. Here's what each number means:
3
Three Copies of Your Data
Keep at least 3 total copies of your data — the original production data plus 2 backups. One copy is never enough because backups themselves can fail.
2
Two Different Storage Media
Store copies on at least 2 different types of media — for example, one on a local NAS and one on a separate external drive or tape. This protects against single-device failure.
1
One Copy Off-Site
At least one copy must be stored off-site — whether in the cloud or a physically separate location. If a fire or flood hits your office, your on-site backups are gone with it.
+1
One Immutable or Air-Gapped Copy
The modern addition. One copy must be immutable (cannot be modified or deleted, even by administrators) or completely air-gapped from your network — making it immune to ransomware.
Why the Extra "1" Matters So Much Now
Modern ransomware is sophisticated. It doesn't just encrypt your live data — it hunts for connected backups and encrypts those too. Businesses that thought they were protected have watched their backups get wiped alongside their primary systems in the same attack. An immutable backup stored in a write-once location or completely disconnected from the network is the last line of defence ransomware cannot breach.
Backup Is Not the Same as Recovery
Many businesses have backups — very few have actually tested their recovery. A backup you've never restored from is a backup you don't really have. Best practices include:
- Schedule regular test restores — at minimum quarterly, ideally monthly for critical systems.
- Document your Recovery Time Objective (RTO) — how long can your business survive without its systems?
- Define your Recovery Point Objective (RPO) — how much data loss is acceptable? Hours? Minutes? Zero?
- Monitor backup jobs daily — a failed backup job that goes unnoticed for a week is a silent disaster waiting to happen.
- Use solutions like Veeam that provide immutable backups, granular restore, and instant VM recovery.
Is Your Backup Strategy Bulletproof?
We'll audit your current backup setup and identify gaps — at no cost to you.