The traditional 3-2-1 rule means three copies of the data, on two types of storage media, with one copy off site. The working data counts as one copy. The rule helps separate failures, but copy count alone does not establish recoverability.
A concrete example
A file server holds the working data. A local backup repository holds a second copy. A tape stored at another location holds a third copy and is disconnected after writing. This example combines two media types, an off-site copy and an offline copy. It is one possible design, not a requirement to buy tape.
Read the diagram as text
3-2-1 BACKUP · TEACHING EXAMPLE Where are your three copies? WORK SITE COPY 1 COPY 2 Working data Local backup Disk-based server Separate equipment Disk storage COPY 3 · ANOTHER SECURE LOCATION Tape removed from the drive after writing Off site + offline Recovery also needs the drive, transport and keys. 3 copies · 2 media types: disk and tape INITIAL INFRA · Adapt to your needs and test restoration.
The French ANSSI backup guide describes its own formulation and recommends offline protection. When a proposal says "3-2-1", ask the provider to draw the actual locations, media, access paths and administrative dependencies. Different uses of the label can hide different protection.
Off site, offline and immutable answer different questions
| Property | What it addresses | What to check |
|---|---|---|
| Off site | A fire, theft or outage affecting the original location | Is the other location sufficiently independent? |
| Offline | An attacker reaching copies through a connected system | When is the copy connected, and who controls that step? |
| Immutable | Alteration or deletion during an enforced retention period | What is locked, for how long, and can an administrator bypass it? |
An off-site repository can still be reachable using compromised company credentials. An immutable repository can still fail to contain the file or date you need. Record where encryption keys are kept and how they remain available if the original system is lost.
What should not be counted as an independent backup
RAID helps a storage system tolerate certain disk failures; it does not retain an independent historical copy after deletion or ransomware. Synchronisation can propagate unwanted changes. A NAS is a device, not evidence of a complete backup policy. Its role, history and protection determine whether it contributes a useful copy.
A permanently connected USB drive can be deleted or encrypted by an account that can write to it. A cloud service's availability commitment does not establish your own retention and restoration scope. For Microsoft 365, check the specific recovery options.
Retention must cover delayed discovery
Some mistakes are noticed immediately; others are found weeks later. Agree the history needed for the actual data and detection delay. Test a selected older recovery point as well as the latest one.
During an incident, identify the last known clean copies before routine rotation removes them. Preserve the required recovery points using an authorised procedure while investigation and restoration continue. This is a practical safeguard, not a claim that a fixed number of days suits every organisation.
Evidence to request
Ask for the protected scope, job results, retained recovery points, storage locations, administrative separation and a dated restore test. The test should record whether the restored data opened correctly and whether the intended users could use it.
Use this worksheet
Map your backup copies
Describe each copy and its evidence. Ask the administrator to resolve unknowns. Do not enter passwords.
Complete the worksheet
Nothing is sent or saved automatically. Download your answers before leaving the page.
This worksheet does not certify the architecture. Copies can share a weakness: building, account, key or provider.
Use the business backup test kit to practise on fictional files. A successful sample restore establishes that sample's result, not the recovery of a whole application or site.