Backups: the 3-2-1 rule explained
Hardware failure, theft, human error or ransomware: a recent, restorable backup is what separates an annoying incident from a disaster. The 3-2-1 rule provides a simple method to get there.
Kayzen Security editorial team3 min read
The 3-2-1 rule in practice
Example for a small organisation: working data on the server or in online storage (copy 1), a daily backup to a NAS at the office (copy 2), and an encrypted backup to an external service or to a disk taken off the premises and unplugged (copy 3).
For a household: photos on the computer, a copy in an online service and a copy on an external disk stored away and unplugged between backups.
Why an offline copy
Ransomware encrypts everything it can reach, including network drives and permanently connected backups. A copy that is unplugged, or stored in a service that prevents modification for a set period (known as an immutable backup), remains intact.
What to back up
- Working documents, accounts, customer databases, contracts.
- Mailboxes and collaborative workspaces: an online service is not a backup in itself, so check what your provider actually keeps and for how long.
- Configurations of equipment and business software.
- The information needed to rebuild everything: list of software, licences, provider contacts.
Testing restoration
- Regularly restore a few files at random to check that they open.
- At least once a year, simulate the loss of a computer or a server and measure the time needed to get back up and running.
- Check that backups actually run: an alert in case of failure is better than finding out on the day of the breakdown.
- Protect access to backups with separate credentials and two-factor authentication.
Personal data
Backups often contain personal data: they must be encrypted, access to them restricted, and their retention period consistent with that set for the original data, as the CNIL points out.
Official sources
- ANSSI (new tab) — Agence nationale de la sécurité des systèmes d'information — guides et publications
- Cybermalveillance.gouv.fr (new tab) — Assistance et prévention en sécurité numérique (fiches réflexes, prestataires ExpertCyber)
- CNIL (new tab) — Commission nationale de l'informatique et des libertés
The resources cited are published by their authors in their original language. Kayzen is not affiliated with any of these organisations.
This guide is general and for information only. It does not replace legal advice or the help of an IT security professional.