The 3-2-1 Backup Rule (and 3-2-1-1-0) in Practice

Having backups versus being able to restore

When we ask "do you have backups?", almost everyone says yes. When we ask "when did you last restore from them?", the room usually goes quiet. The 3-2-1 rule exists so that when one thing fails, another copy still works. This guide shows how to set it up and how to prove it works before you need it.

The 3-2-1 rule

• 3 copies of your data: production plus two backups
• 2 different media or systems (for example NAS disk plus cloud object storage or tape)
• 1 copy offsite

Why it became 3-2-1-1-0

Modern ransomware looks for backups and deletes them before encrypting. A NAS joined to the same domain, or mapped as a drive, gets destroyed along with everything else. So two more rules were added:

• 1 copy that is immutable (cannot be changed or deleted until retention expires, even with admin credentials) or offline / air-gapped
• 0 errors: backups are verified automatically and restores are actually tested

A layout we use often for 20–150 person offices

Backup 1 should use separate credentials, not be domain-joined, and expose no share that ordinary users can see.

Tools that do this well include Veeam (version 13 arrived in 2025 with a pre-hardened Linux appliance, and its hardened repository provides immutability), Synology Active Backup for Business with immutable snapshots, and QNAP Hybrid Backup Sync. Choose by size and by your team's skills, not by reputation.

Decide RPO and RTO before buying anything

• RPO: how much data can you afford to lose? Nightly backups mean an RPO of about 24 hours.
• RTO: how quickly must the system be running again?

These two numbers drive the budget. An RPO of one hour needs frequent backups or replication. A two-hour RTO for the ERP needs a local restore, because pulling 2 TB from the cloud over a 100 Mbps line takes more than 40 hours.

These are starting points. Agree the final numbers with management, because they are the ones who will face customers when a system is down.

Worked example: put numbers on the restore

A 60-person company holds 4 TB (3.5 TB file server, 0.5 TB ERP). Internet is 50 Mbps up, 100 Mbps down.

The lesson: the cloud is a good place for the last-resort copy, not for fast restores. Bring the ERP back first from the local NAS, then restore the rest in order of importance. If management needs a shorter RTO than this, you need 10 GbE between NAS and server, or instant recovery that runs the VM straight from the backup.

Three things people mistake for backup

RAID. It survives a failed disk. It does not protect against deletion, ransomware or a failed controller.

OneDrive or Google Drive sync. If files are encrypted on a laptop, sync uploads the encrypted versions. Version history helps, but only for a limited window.

Microsoft 365 or Google Workspace on their own. The provider is responsible for the infrastructure and availability. Protecting against user deletion, a compromised admin, or needing data older than the platform's retention is your responsibility. Use third-party backup, or the provider's own paid backup service, for mailboxes, OneDrive and SharePoint, or Google Drive.

How long to keep backups

Attackers often sit in a network for weeks before striking, so seven days of backups may contain only infected copies. A GFS scheme is a good starting point:

Power, bandwidth and branches

Power. A NAS that loses power mid-write can corrupt the repository or trigger a RAID rebuild that runs for hours. Backup NAS units and servers must sit behind a UPS that signals automatic shutdown over USB or a network card. Test it once by actually pulling the plug. See our UPS sizing guide.

Bandwidth. A first full backup of 3 TB over a 50 Mbps upload takes about six days at full line rate. At that size, seed with a disk and send incrementals only, and throttle during working hours.

Provincial branches and mine sites. Keep a local backup for fast restores and replicate overnight to Vientiane or the cloud. Don't forget executive and site engineer laptops, which often hold the only copy of important documents.

Floods and heat. A ground-floor server room near a river is a real rainy-season risk. The offsite copy has to be far enough away that the same flood can't reach it.

Write your backup and recovery procedure down, and always keep backups in more than one location. A flood or fire in a single server room should never take every copy with it.

How to test a restore

Testing doesn't have to be a big event. Each quarter, pick one system: restore the ERP VM into an isolated test network, have one accounts clerk log in and open yesterday's report, and record the time from start to usable. That figure is your real RTO, not the one in the specification. Once a year, have someone other than the main admin do a restore by following the written procedure. If they can't, the document needs fixing.

Common mistakes

• Backups have been failing for months and nobody knew. The alert emails go to the mailbox of someone who left.
• The NAS uses the same admin password as the domain. An attacker who gets domain credentials can delete the backups straight away.
• Files are backed up but databases are not handled properly. Copying database files while they are open can produce a copy that won't mount. Use application-aware backup.
• The encryption key is stored on the server being backed up. When the server is lost, so is the key.
• Assuming the cloud restores quickly. See the example above: 4 TB takes almost four days.

For the wider ransomware picture see our ransomware protection checklist, and for choosing where data lives see NAS vs SAN vs cloud storage.

Checklist

1. Inventory of all data and systems, each with an owner.
2. RPO/RTO targets signed off by management.
3. Backup software covering VMs, physical servers and Microsoft 365 or Google Workspace.
4. Immutability enabled on at least one repository.
5. Offsite backups encrypted, with keys stored somewhere other than the same server.
6. Quarterly restore tests, with the time taken recorded.
7. Failure alerts going to someone who reads them.
8. Written restore steps that someone else can follow when the main admin is away.

Brands we supply & install for backup include Veeam, Synology and QNAP. More on our backup and disaster recovery page.

Let's work out your restore time

Tell us roughly how many TB you hold, which systems matter most, and your internet upload speed. We'll calculate how long the first backup and a full restore would take, then design so the RTO you need is actually achievable.