The 3-2-1 Backup Rule: Why It's Still the Gold Standard for Business Data Protection

The 3-2-1 backup rule has been a foundational principle of data protection for decades. Originally articulated by photographer Peter Krogh in the context of digital photography, it was adopted by the IT industry because it elegantly addresses the three most common causes of data loss: hardware failure, human error, and site-level disasters. In 2025, ransomware has made it more important than ever — and has exposed exactly why so many "backup strategies" that businesses think they have are actually dangerously insufficient.

The 3-2-1 Rule Explained

• 3Copies of your data (the original plus two backups)
• 2Different media types (e.g. local NAS plus cloud storage)
• 1Offsite copy (geographically separate from primary data)

The logic is straightforward. If you only have the original and one backup on the same device or network, a single hardware failure can destroy both. If both copies are on the same site, a fire, flood, or physical theft wipes them simultaneously. The offsite copy survives site-level disasters. The multiple media types protect against media-specific failures.

Why OneDrive and Dropbox Are Not Backups

This is the most common misconception we encounter. "We use OneDrive, so we're backed up" is something we hear regularly — and it represents a serious misunderstanding of what cloud sync services do.

OneDrive, Dropbox, and SharePoint are synchronisation services. Their job is to keep files consistent across your devices. That means if a file is deleted — whether by accident, by ransomware, or by a departing employee — that deletion is synchronised across every device. The file is gone everywhere, simultaneously.

Microsoft 365's recycle bin and version history provide some protection for limited periods, but they are not a substitute for proper backup. Ransomware operators know this — their malware is specifically designed to encrypt or delete files in OneDrive-synced folders, triggering synchronisation of the encrypted versions across all devices.

How Ransomware Targets Backup Systems

Modern ransomware groups devote specific effort to identifying and destroying backup systems before deploying the encryption payload. Common tactics include:

• Deleting Volume Shadow Copies (Windows' built-in previous versions feature) using built-in Windows commands.
• Identifying and encrypting NAS devices and network-accessible backup repositories.
• Targeting backup software consoles (Veeam, Acronis) and deleting recovery points before encrypting.
• Waiting weeks before deploying encryption so that backup retention periods roll over and clean backups are overwritten.

A backup stored on a network share accessible with the same domain credentials as your regular systems is not a safe backup — it's just another target. The offsite, isolated copy is the one that actually saves you.

The Modern Standard: 3-2-1-1-0

In response to the ransomware threat, backup experts and vendors have extended the original rule. The 3-2-1-1-0 rule adds:

• +1 Immutable copy: At least one backup copy is stored in a write-once format that cannot be modified, deleted, or encrypted by ransomware — even if the backup system's admin credentials are compromised. Object-locked cloud storage (e.g., Wasabi, Backblaze B2, or Amazon S3 with Object Lock) provides this.
• +0 Errors: Verified, tested restores with zero errors. A backup that fails to restore is not a backup. Regular automated restore testing catches problems before you actually need to recover.

RTO and RPO: The Numbers That Actually Matter

Two metrics define the practical value of your backup strategy:

• Recovery Time Objective (RTO): How long can your business tolerate being down? If the answer is "a few hours," your backup solution needs to be able to restore operations in that timeframe — which often requires a local copy and a documented recovery procedure, not just a cloud-only backup.
• Recovery Point Objective (RPO): How much data loss is acceptable? If you back up nightly and a ransomware attack hits at 3pm, you could lose up to a full day of data. Hourly snapshots reduce this to one hour of data loss — but cost more in storage and backup software.

Most SMBs have never formally defined their RTO and RPO. Having this conversation with your IT provider is one of the most valuable things you can do — it shapes every decision about your backup architecture.

Key Takeaways

• OneDrive and Dropbox are sync services — they replicate deletions and encryptions in real time and are not substitutes for proper backup.
• Ransomware specifically targets and deletes backup systems before encrypting production data — your backups must be isolated and immutable.
• The 3-2-1-1-0 extension adds immutability and verified restore testing to the original rule — both are now essential.
• Define your RTO and RPO before choosing a backup solution — these numbers determine the architecture you need.