How the 3-2-1 backup rule works
The simple 3-2-1 backup rule explained: three copies, two types of storage, one off-site, plus why immutable backups and restore testing matter.
3 November 2026 · 0:50
If your server died tonight, how much work would you lose? A day? A week? Everything? For many small businesses the honest answer is "I'm not sure", and that's the problem.
The simplest way to be ready is the 3-2-1 backup rule.
3 copies of your data
Your live data, plus two backups. One backup is good; two means a single failed or corrupted backup isn't the end of the story.
2 different types of storage
Keep your copies on at least two different kinds of storage, for example a local backup device and a cloud backup service. That way one failure, a faulty drive or a provider outage, can't take out everything at once.
1 copy off-site
Keep at least one copy away from your office. If there's a fire, flood or break-in, the backup sitting next to your server goes with it. Cloud backup makes off-site easy.
Going further: offline and immutable
Modern threats like ransomware go looking for backups and encrypt or delete them too. That's why many businesses now go a step further, sometimes called 3-2-1-1-0.
- One copy offline or immutable. Immutable means it can't be changed or deleted for a set period, even by an administrator, and even by ransomware.
- Zero errors when you test a restore.
Don't forget the cloud
Microsoft 365 and Google Workspace keep your data available, but they're not a full backup. Deleted items, overwritten files and compromised accounts can still mean lost data. A dedicated cloud-to-cloud backup closes that gap.
Test it
None of it matters unless you test it. A backup you've never restored is just a hope. Backups fail silently: jobs stop running, drives fill up, passwords change. Regular test restores, even of a single folder, prove it actually works and show how long recovery takes.
Quick checklist
- Do you have at least two backup copies?
- Is one of them off-site?
- Is one offline or immutable?
- When did you last successfully restore something?
- How long could your business run without its data?
The bottom line
The 3-2-1 rule is simple, affordable and works. Add an immutable copy and regular testing, and a dead server or ransomware attack becomes an inconvenience rather than a catastrophe.
Not sure your backups would pass the test? Have a look at our useful free tools at nexcentric.com.au/tools, or ask Nexcentric to review your backup setup.
Full transcript
If your server died tonight, how much work would you lose? The simplest way to be ready is the three, two, one backup rule. Three copies of your data, your live data, plus two backups. Two different types of storage, so one failure can't take out everything. And one copy off-site, away from your office, so a fire, flood or break-in can't destroy it all. Many businesses now go further, keeping one copy offline or immutable. That means it can't be changed or deleted, even by ransomware. And none of it matters unless you test it. A backup you've never restored is just a hope. Nexcentric.
Other episodes
Episode 01 · 1:21
How DNS works (and how attackers hijack it)
Episode 02 · 1:21
How MFA works (and how attackers get around it)
Episode 03 · 1:09
How AI language models work
Episode 04 · 1:13
How ransomware works
Episode 05 · 1:02
How phishing works
Episode 06 · 1:03
How HTTPS works
Episode 07 · 1:03
How the Essential Eight works
The Weekly Byte
The week in cyber and AI, for a business your size.
Weekly cyber and AI news for small and medium businesses, one practical tip, and links to our free tools.
What you’ll getWant a second look at the registrar account?
Book a free 30-minute review. We'll tell you what we find, including if the honest answer is that it's already in good shape.
- Free 30-minute review
- Written findings you keep
- No obligation, no sales pressure