The 3-2-1 backup rule: what it means and how we apply it

The 3-2-1 backup rule says that a company should keep three copies of its data on two different types of media, with one copy off site. The three copies are the original and two backups. With this setup, a single disk failure, theft, office fire or staff mistake does not mean losing data. Ransomware has added two more conditions: one copy that cannot be changed or deleted, and regular restore tests. This variant is called 3-2-1-1-0.

At Conetso Group, we build backups on products from our partners Veeam, Synology and QNAP. Below is how we apply each part of the rule in a company.

The 3-2-1 rule in practice

Element	What it means	Example in a small company
3 copies	production data plus two backups	files on the server, a copy on a network-attached storage (NAS) device, a copy outside the office
2 types of media	the copies are not on the same device or the same type of storage	server disks and a separate NAS device or the cloud
1 copy off site	one copy survives an event that affects the whole office	a second NAS at another location or a repository in the cloud

A common mistake is a backup on a USB drive permanently connected to the server. Formally it is a second copy, but in practice it is lost along with the server: in a power surge, a theft or when ransomware encrypts it.

RAID and cloud sync do not replace backups

These are two common misunderstandings.

RAID protects against the failure of a single disk. If someone deletes a folder or ransomware encrypts files, RAID faithfully repeats that change on every disk.

Synchronisation, such as a folder synced with the cloud, works the same way. A deleted or encrypted file is also deleted or encrypted in the cloud. The recycle bin and version history help, but only for a limited time. They do not replace an independent copy.

A backup is a separate, versioned record of the data at a given moment, from which you can restore the state before the failure.

What is the 3-2-1-1-0 rule?

Veeam, a backup software vendor, extends the classic rule with two elements (the 3-2-1-1-0 rule on the Veeam website, as of 31 August 2026).

The extra one stands for an immutable or isolated copy. Such a copy cannot be modified or deleted for a set period, even with administrator rights. It can also be a copy physically disconnected from the network. It protects against attacks in which criminals find and delete backups before encrypting the data.

The zero stands for no errors on restore. Backups are checked regularly and restores are tested. A backup that nobody has ever tried to restore is only an assumption.

The products we build backups on

The choice depends on what we are protecting:

• Veeam for backups of servers, virtual machines and Microsoft 365. It is our main tool: it can restore a whole system or single files, send a copy off site and lock it against changes.
• Synology and QNAP NAS devices as the backup repository in the office. A second such device at another location receives replicated copies.
• The cloud as the off-site location when the company has no second office.

We configure the immutable copy and the off-site copy in Veeam. The backup goes to a repository locked against changes. We choose the off-site location to suit the company: another site, a private cloud or a public cloud.

How we set up backups for a company

Each setup depends on the company, its data and its budget. The steps below are an example we often start from, not the only way:

1. Data inventory. We list where the data is: servers, accounting and line-of-business software databases, network shares, email and files in Microsoft 365, and data on laptops.
2. Two parameters. The first is the RPO (recovery point objective), meaning how much data you can afford to lose, such as one day’s work. The second is the RTO (recovery time objective), meaning how quickly a system must be back. They decide how often backups run and how restores work.
3. Hardware and licences. We set the repository capacity, the number of devices and the off-site location.
4. Configuration. We set schedules, retention periods, backup encryption, failure notifications and separate accounts for managing backups.
5. Restore test. We restore selected files and a system before we consider the setup complete.
6. Documentation. We describe what is backed up, where and how often, and the restore procedure.

The setup time depends on the state of the infrastructure, so we give it after the inventory. For clients on a monthly plan (a fixed monthly fee covering a set number of hours from our specialists), we repeat restore tests regularly, at a frequency that depends on the plan and is set in the contract.

Does data in Microsoft 365 need a backup too?

Yes. The recycle bin, retention of deleted items and version history in Microsoft 365 work for a limited time. They do not cover every situation, such as a former staff member’s mailbox that was deleted and is needed again months later. For backups of email, OneDrive, SharePoint and Teams, we recommend Veeam Backup for Microsoft 365. We plan the Microsoft 365 backup scope together with the server backups, so all company data follows the same rules.

How much does setting up backups cost?

We give an individual quote for setting up backups. The price depends on:

• the amount of data and the number of servers
• whether the backup covers virtual machines, workstations and Microsoft 365
• how the off-site copy is stored (a second device or the cloud)

Hardware (NAS, disks) and software licences are quoted separately, at current manufacturer prices. Our business software page sets out what our backup and virtualisation work covers.

How to check whether your backup works

Answer five questions:

• When did someone last restore a single file and a whole server from backup?
• Does anyone receive a notification when a backup fails, and does anyone read it?
• Is the off-site copy up to date?
• Is the account that can delete backups different from the domain administrator account?
• Do you know how many hours it takes to restore your most important system?

If you cannot answer any of these, your backup needs checking. Backups are also the last line of defence against an attack. We write more about detecting threats in our article on threat monitoring and incident response.

To have your backups checked or to plan new ones, get in touch.