[{"data":1,"prerenderedAt":146},["ShallowReactive",2],{"publication:en:P169":3},{"meta":4,"copy":16,"relatedArticles":132,"terms":133,"term":134,"resourceParent":140,"glossaryParent":143},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15},"P169","\u002Fglossary\u002F3-2-1-backup","term","what is the 3-2-1 backup rule","What is the 3-2-1 backup rule? Copies, separation and recovery","What is the 3-2-1 backup rule? Copies and recovery","Understand three copies, two media types and one offsite copy. Check shared failure risks, access separation and restoration beyond the copy count.",[13,14],"\u002Fservices\u002Fbackups","\u002Fservices\u002Fweb-resilience-audit","2026-10-30",{"intro":17,"sections":18,"checklist":91,"faq":97,"links":107,"sources":124,"cta":127},"The 3-2-1 backup rule means keeping at least three copies of important data, including the original and two backups, using two different media types and keeping one copy offsite. It is a separation principle, not proof of recoverability. Check shared failure risks, protected access, retained history and actual restore results in addition to counting copies.",[19,28,64,73,81,86],{"title":20,"paragraphs":21,"sources":24},"Count the original and the two backup copies correctly",[22,23],"The Netherlands NCSC explains the traditional 3-2-1 structure as original data plus two backup copies, two different media and a copy in another location. Use that as the starting vocabulary. Three folders on one drive are not three independent recovery arrangements, and two copies plus the original should not be described as three additional backups.","Identify the actual dataset before counting. A website can need application data, uploaded files and configuration, while a mailbox recovery may need a different scope. A copy that excludes essential components cannot fill the gap merely because another storage location exists. Record what each copy contains and how it connects to the business service that would need to be restored.",[25],{"label":26,"url":27},"Netherlands NCSC: 3-2-1 backup copies, media and location","https:\u002F\u002Fwww.ncsc.nl\u002Fen\u002Fbackup\u002Fall-about-good-backups",{"title":29,"paragraphs":30,"table":33},"Map shared failure risks across the copies",[31,32],"Copy count alone can hide a common dependency. Several copies may share one administrator, account, storage system, encryption key or deletion path. A local problem, credential compromise or service failure can then affect more than one copy. Our copy-and-failure map helps the owner identify that dependency without declaring every cloud or physical-storage design equivalent.","Record which separation is actually achieved and what remains shared. Different folder names or logical storage labels do not explain resilience by themselves. If a provider describes independent storage or protected retention, ask what that means for access and recovery. Keep unsupported assumptions visible and agree what evidence would establish the required protection for the actual business data.",{"caption":34,"headers":35,"rows":39},"Copy, failure-domain and recovery map",[36,37,38],"Review point","What to record","Question still to answer",[40,44,48,52,56,60],[41,42,43],"Original data","Business dataset and current operating location.","What must be recovered for the service to work?",[45,46,47],"Backup copies","Contents, location and creation process.","Are essential components included?",[49,50,51],"Media\u002Fstorage diversity","Actual storage and relevant shared dependencies.","Which failures could affect multiple copies?",[53,54,55],"Offsite location","Location and service dependency outside the primary site.","Does the intended location separation exist?",[57,58,59],"Administrative protection","Who can change, encrypt or delete copies.","Could one compromised account destroy recovery?",[61,62,63],"Restoration","Selected point, environment and tested functions.","What has actually been demonstrated?",{"title":65,"paragraphs":66,"sources":69},"Treat offline and immutable protection as additional properties",[67,68],"Offsite, offline and immutable describe different characteristics. A copy can be in another location while remaining accessible through the same administrative account. Protection against deletion or alteration also needs its actual configuration, scope and owner. The UK NCSC's protected-backup guidance focuses on resistance to destructive actions, rather than assuming cloud or on-premises storage has that property by default.","Ask how significant retention, access or deletion changes are authorized and who notices failures. Do not describe an ordinary remote folder as immutable or an always-connected copy as offline. If a provider offers a protective feature, verify the setting and its limitations in the purchased plan. The business needs an operational explanation of what survives the chosen failure scenario, not a collection of reassuring labels.",[70],{"label":71,"url":72},"UK NCSC: protection principles for ransomware-resistant backups","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fransomware-resistant-backups",{"title":74,"paragraphs":75,"example":78},"Connect the copy plan to recovery objectives and history",[76,77],"The rule does not specify how much recent work the business can lose or how quickly its functions must return. Those recovery objectives need their own decisions. It also does not set a retention period. A business may keep multiple copies while rotating away every recovery point that predates a late-discovered error or unwanted change.","Define the important scenarios and review the history actually available. Separate backup frequency from retained generations, access protection and the restore process. A copy that is technically present may require a provider, an unavailable credential or a data-reconciliation decision before it becomes useful. Record these dependencies and agree the required acceptance rather than translating a copy count into a recovery-time promise.",{"title":79,"text":80},"Illustrative example: three copies, one deletion authority","A fictional business keeps production data and two remote copies, but one administrator can immediately remove all of them. The owner records that shared destructive-access dependency and reviews a more protected recovery arrangement. The example illustrates a missing protection question; it is not a test of a provider, a customer incident or a claim that a particular design meets every backup objective.",{"title":82,"paragraphs":83},"Test recovery as a business result",[84,85],"Select a representative recovery point and restore into a controlled environment. Verify the data and functions needed by the business, with synthetic transactions or supported test modes where relevant. Keep production credentials and external actions controlled so a recovery exercise does not send real notifications, overwrite live records or trigger fulfillment. Record the selected point and observed result.","A successful job status or file extraction is useful evidence but not the whole acceptance. Check whether configuration, permissions and dependencies were recovered too. Keep excluded data and remaining uncertainty in the report. If the recovery point may contain an unwanted change, address trust and incident questions separately; backup separation does not itself prove that a copy is clean or that confidentiality was preserved.",{"title":87,"paragraphs":88},"Assign owners for the copies and the next restore check",[89,90],"Keep a named business owner for recovery requirements and a technical owner for backup operation, access and failure handling. Revisit the plan when data, providers or administrative accounts change. Store the inventory and instructions securely without making one open document the source of every recovery secret. A usable handoff should explain what is protected, what is shared and who can restore it.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli website and digital-infrastructure knowledge. We can discuss scoped backup and restoration work described on this site. We do not guarantee data recovery, ransomware resistance or a particular restoration time from a copy-count rule. Agree the actual dataset, protection, restore scope and evidence of acceptance before work begins.",[92,93,94,95,96],"Count the original plus two backup copies.","Record actual contents, media and location separation.","Identify shared accounts and destructive-access dependencies.","Set history and recovery objectives independently of copy count.","Verify a controlled restore and assign ongoing owners.",[98,101,104],{"question":99,"answer":100},"Does 3-2-1 mean three backups plus the original?","The traditional rule counts three copies in total: the original and two backups, with media and location separation.",{"question":102,"answer":103},"Is an offsite copy automatically offline or immutable?","No, location, connectivity and protection against change or deletion are separate properties that need their own evidence.",{"question":105,"answer":106},"Does meeting the copy rule prove I can recover?","No: check coverage, consistency, access, history and actual restoration of the required business functions.",[108,111,114,117,120,122],{"path":109,"label":110},"\u002Fblog\u002Fwebsite-backup-retention","Plan usable restore history",{"path":112,"label":113},"\u002Fblog\u002Fbackup-access-separation","Review backup administrative separation",{"path":115,"label":116},"\u002Fblog\u002Fbackup-restore-test","Verify a controlled restoration",{"path":118,"label":119},"\u002Fglossary\u002Fimmutable-backup","Understand immutability and its scope",{"path":13,"label":121},"Scope backup and restore work",{"path":14,"label":123},"Discuss recovery dependencies and readiness",[125,126],{"label":26,"url":27},{"label":71,"url":72},{"title":128,"description":129,"button":130,"type":131},"Review the recovery behind the backup copy count","Describe the important dataset, current backup arrangement and recovery concern without sharing backup credentials or customer records.","Discuss the backup scope","check",[],[],{"name":135,"aliases":136},"3-2-1 backup rule",[137,138,139],"three-copy backup rule","3 2 1 backup","backup copy separation",{"path":141,"label":142},"\u002Fresources","Website security resources and templates",{"path":144,"label":145},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058035]