The 3-2-1 Backup Rule: Why It Still Works in 2026

The 3-2-1 rule is simple: keep at least three copies of your data, on at least two different types of media, with at least one copy offsite. It predates both ransomware and cloud storage, but it's aged well because it directly targets the most common way backups actually fail — not the absence of a backup, but a backup that shared a single point of failure with the data it was meant to protect.

A backup on a second internal drive protects against that one drive failing — but not against theft, fire, or a ransomware variant that specifically targets attached and network drives, which most modern ransomware does. A backup replicated only to a second server on the same network is vulnerable to the same network-level compromise as the original. The '2' (two media types) and '1' (offsite) parts of the rule exist specifically to break these shared failure modes.

Modern ransomware actively searches for and encrypts or deletes backups it can reach — including mapped network drives, connected external disks, and cloud sync folders with live write access. This is why immutable or air-gapped backups (a copy that, once written, cannot be modified or deleted even by an account with admin credentials, for a defined retention period) have become the practical extension of the '1 offsite' rule: offsite alone doesn't help if the offsite copy is still writable from a compromised network.

Having backups and being able to restore from them are different things. A backup that has never been test-restored is a hypothesis, not a safety net — corrupted backup files, incomplete transaction log chains, and permission issues that only surface at restore time are common enough that periodic test restores (even quarterly) are cheap insurance against discovering a backup doesn't work at the exact moment it's needed.