What is a backup strategy based on the 3-2-1 rule?

Backup strategy: definition and goal

A backup is a safety copy of data. A backup strategy goes further: it systematically describes which systems are backed up, at what frequency, with what retention period and who is responsible for monitoring and restoration.

Two metrics help with planning. The RPO (recovery point objective) describes the maximum acceptable data loss—such as one day’s work. The RTO (recovery time objective) defines how quickly a system must be up and running again. These two values determine the backup interval, storage location and recovery procedure.

How the 3-2-1 rule works

The 3-2-1 rule is a simple principle that prevents a single event from destroying all copies at once—whether it is a hardware failure, a fire or ransomware.

Today, the rule is often extended to 3-2-1-1-0: one copy is additionally stored offline or immutably, and regular restore tests complete without errors. Multiple versions spanning days, weeks and months also make it possible to go back to a point in time before an unnoticed error or attack.

• 3 copies: the original data plus two backups
• 2 storage types: for example, NAS and cloud storage or a tape drive
• 1 off-site copy: in another building or data center

Benefits and common miscon­cep­tions

A well-thought-out backup strategy protects against data loss caused by defects, accidental deletion, theft and cyberattacks. It shortens downtime and helps meet requirements for the prompt restoration of data, such as those set out in the GDPR. This article does not replace legal advice.

Common misconceptions: RAID mirroring or cloud synchronization is not a backup—deleted or encrypted files are copied over immediately. And a backup whose restoration has never been tested is a risk in an emergency. Backups that can be reached on the same network and with the same credentials as the production systems are just as risky.

Real-world example: a backup strategy for SMEs

A company with a file server, an inventory management system and Microsoft 365 backs up its servers daily to an on-premises NAS. From there, an encrypted copy is transferred overnight to a German data center, where it cannot be altered for a defined period. The cloud data from Microsoft 365 is also backed up separately.

Once a quarter, the restoration of a system is rehearsed and documented. This shows whether the planned times are realistic. Nano Concepts plans backup concepts for websites, applications and databases and sets up automated backups including monitoring; for workstations and on-site servers, our IT service partners are on hand.