The 3-2-1 backup rule says you should keep three copies of your data (the live data plus two backups), on two different types of storage, with one copy held off-site. It is the simplest widely used standard for backups, and ENISA describes it in the same terms: three complete copies, two stored locally on different media, and at least one off-site. This guide explains how to apply it in a real Irish business, why ransomware has made a fourth and fifth element necessary, and how to set retention and restore testing so the backups actually work on the day you need them.
TL;DR
- The 3-2-1 rule means three copies, two media types, one off-site copy. It protects against hardware failure, site disasters and human error.
- On its own it is no longer enough against ransomware. Add one immutable or air-gapped copy and verified restores: the 3-2-1-1-0 approach.
- Microsoft 365 and Google Workspace data still needs its own backup, separate from the service itself.
- A backup you have never restored is an assumption. Test restores into a non-production environment on a schedule you can defend.
- Keep backups for as long as the business need or legal duty requires, and no longer, because retained personal data is a risk too.
Table of Contents
- What the 3-2-1 backup rule actually says
- A worked example for a 25-person Irish office
- Is the 3-2-1 rule outdated?
- How well do Irish SMEs actually back up?
- Decide your RPO and RTO before you pick tools
- Applying the rule to Microsoft 365 and cloud data
- Backup is not the same as redundancy
- Setting a backup retention policy
- Backup restore testing: how often and how
- Perspective: what we see on the ground
- How LANCAST can help
- FAQ
- Sources
What the 3-2-1 backup rule actually says
Each number answers a specific failure.
Three copies. Your working data counts as the first copy. You then hold two further backups. A single backup can be corrupt, incomplete or accidentally overwritten, and two independent backups make it very unlikely that both fail together.
Two media types. The copies should not all depend on the same kind of technology. A server and a NAS device on the same network share too many weaknesses, such as the same firmware flaw, the same power surge or the same administrator credentials. A common pairing is a local disk-based appliance plus cloud storage, or disk plus tape.
One off-site. At least one copy must live somewhere a fire, flood, burglary or building-wide power failure cannot reach. In practice that means a cloud repository or a physically separate location.
A note on terminology, because the rule is explained inconsistently online: some writers count the original as a copy, others count only backups. The ENISA wording of three complete copies is the clearer reading, and it is the one we use with clients. What matters is that you end up with at least two independent backups of the live data, not the arithmetic.
A worked example for a 25-person Irish office
Take a professional services firm with a file server, a line-of-business database and Microsoft 365 for email and documents.
The live data sits on the server and in Microsoft 365. The first backup is a nightly image of the server to a dedicated backup appliance in the comms room, which gives fast restores of a single file or a whole machine. The second backup is an encrypted copy of that data sent to a cloud repository in a separate location, which is both the second media type and the off-site copy. Microsoft 365 mailboxes, OneDrive and SharePoint are backed up by a separate service, not left to the platform alone.
That design satisfies 3-2-1. It survives a failed disk, a stolen server, a flood in the building and a member of staff deleting a folder. What it does not yet do is guarantee survival of a ransomware attack, and that is where most modern advice has moved on.
Is the 3-2-1 rule outdated?
The rule is not wrong, but it was written for a world of failing disks and fires, before attackers routinely went looking for backups. Modern ransomware operators try to find and encrypt or delete backup repositories before they trigger the main attack. If your backup appliance is domain-joined and reachable with the same admin credentials as your servers, a compromised administrator account can reach all three copies at once. Three copies that can all be deleted by one login are really one copy.
The response, which has become common among backup professionals, is an extended rule often written as 3-2-1-1-0. It keeps the original structure and adds two things:
- One more copy that is offline, air-gapped or immutable. It cannot be altered or deleted, even by someone holding administrator rights, for a defined period.
- Zero errors. Backups are verified automatically and restores are tested, so you know the data is readable and complete.
Irish official guidance points in the same direction. The NCSC, in its 2021 alert on Conti ransomware, recommends that organisations using cloud storage consider immutable or Write-Once-Read-Many (WORM) storage, which stops files being modified, deleted or altered after they are written. It also stresses encrypted, off-site backups and hardware availability, so that an entire operating environment can be rebuilt. Cyber Resilience Ireland describes the same options: immutable storage, where backed-up files cannot be changed, or air-gapped storage, which is physically disconnected from any network.
So the honest answer to whether 3-2-1 is outdated is this: as a minimum it still holds, as a finish line it does not. Treat 3-2-1 as the foundation and 3-2-1-1-0 as the target for any business that would struggle to operate for a week without its data.
How well do Irish SMEs actually back up?
The gap between the rule and practice is large. The SME Cyber Resilience State of the Sector 2025 report, drawing on data from 894 organisations collected across 2024 and 2025, found that 74% of SMEs operate without automated backup solutions and 74% do not keep immutable backups. Only 17% protect their cloud data with a dedicated cloud backup service. Among SMEs that do have a backup schedule, only 32% test their backups more than once a year, and 77% lack a formal cyber incident response plan.
The report concludes that the absence of automated, tested and immutable backups is a critical weakness that prolongs downtime and increases financial loss when an incident happens. Read plainly, most of the damage in a ransomware event is not the encryption itself but the days or weeks spent discovering that the backups are missing, old or unusable.
For the same reason, a good backup design usually starts with a conversation about business backup and disaster recovery plans rather than a product choice. The questions are about the business first: what must come back, how fast, and how much recent work you can afford to lose.
Decide your RPO and RTO before you pick tools
The 3-2-1 rule says where copies live. It does not say how often they are made or how quickly you can recover from them. Two measures fill that gap.
Recovery Point Objective (RPO) is how much data you can afford to lose, expressed as time. The NCSC recommends that backup strategies consider RPO. If your RPO is four hours, backups must run at least every four hours for that system. An accounts package that is updated all day needs a tighter RPO than an archive of finished projects.
Recovery Time Objective (RTO) is the longest downtime the business can accept after a disaster. ENISA suggests aligning backup strategies with business needs by setting explicit RTOs. A cloud-only copy might take days to download for a large dataset, so if your RTO is a few hours you need a local copy as well. That is one practical reason the two-media, local-plus-remote structure exists.
ENISA also notes that as ransomware becomes more common, backup frequency for critical data should rise, and that current storage technology can back up most data sets in minutes. In other words, the old habit of one nightly job for everything is rarely the right answer for the systems that matter most.
A simple way to start is to list your ten most important systems, give each an RPO and RTO that the owner of that system agrees to, and check whether your current backups can meet them. Most firms find two or three systems that cannot.
Applying the rule to Microsoft 365 and cloud data
The most common blind spot we see is the belief that data in Microsoft 365 is already backed up because it is in the cloud. Cyber Resilience Ireland is direct on this: cloud services such as Microsoft Office 365 and Google Workspace are not themselves complete backup solutions and remain vulnerable to ransomware, so business data must also be backed up locally or through a separate cloud backup service.
Applied to 3-2-1, your mailboxes, OneDrive and SharePoint libraries are the live copy. You then need two further copies, one of which sits outside the Microsoft tenant, so that a compromised account, a malicious deletion or a sync of encrypted files does not take every version with it. Our guide to Microsoft 365 backup for Irish SMEs walks through what to protect and how retention behaves, and our cloud backup comparison for Irish businesses sets out the types of service available and what to ask each.
Backup is not the same as redundancy
A frequent confusion, especially in server rooms, is treating RAID as a backup. RAID keeps a system running when a disk fails, and it will happily replicate a deleted file or an encrypted file to every disk. If you are sizing storage for a backup target, a RAID capacity calculator shows how much usable space each level leaves you, but that space is only a place to put backups. It is not a backup by itself. The same applies to file sync tools and snapshots held on the same array as the data they protect.
If your storage is ageing, upgrading it is often the first step in a sound design, and our work on server storage upgrades is built around reducing exactly this kind of risk.
Setting a backup retention policy
Retention answers a different question from frequency: how far back can you go? Three pressures pull in different directions.
Operational need. You may discover corruption or a quiet intrusion weeks after it began. If your oldest backup is only a few days old, every copy may already contain the problem. A tiered schedule, with daily copies for recent weeks, weekly copies for several months and monthly copies for longer, gives you options without keeping everything.
Legal and contractual duties. Tax records, employment records and sector rules each carry their own minimum periods. Your accountant, your solicitor or your sector regulator is the right person to confirm the period for each record type. We do not set those periods for you, and a backup policy should reference them rather than guess.
Data protection. Backups hold personal data, so they fall under GDPR like everything else. The Data Protection Commission’s Data Security Guidance advises that retention should be minimised, that data should be held only for a business need and deleted once that need has passed. It also says the most effective way to reduce the risk of lost or stolen personal data is not to hold it in the first place. The same guidance says the frequency and nature of backups should be assessed according to the type of organisation and the data it processes, and that backup data must be secured to the same standard as live data. That means encryption, access control and logging apply to your backup repository, not just your production systems.
The practical result is a written policy that lists each system, how often it is backed up, how long each tier is kept, where each copy lives, who can delete or change retention, and who reviews the policy and when. One page is enough, provided it is accurate and someone owns it. The DPC also expects controllers to know what personal data they hold, where it is and how it flows, which is difficult to demonstrate if you cannot say what is in your backups.
Backup restore testing: how often and how
The NCSC recommends that every backup strategy undergoes periodic crisis drills in which data is restored to a non-production environment, to validate both the restore procedure and the integrity of the data. That one sentence contains the whole method: restore somewhere safe, and check the result.
The NCSC does not prescribe a frequency, and neither does a single rule that fits every firm. A defensible approach, scaled to risk, looks like this:
- Automated verification after every job. Confirm the backup completed and the data is readable. This is the “zero errors” part of 3-2-1-1-0.
- Regular file-level restores. Restore a handful of files or a mailbox item from a recent and an older backup. Monthly or quarterly works for most small firms, and it also trains staff in the process.
- A full-system restore at least once a year. Rebuild a key server or application in an isolated environment and have its owner confirm it works. The survey figure above shows how rare this is: only 32% of SMEs with a schedule test more than once a year, so even an annual full test puts you ahead.
- A test after every significant change. New servers, a cloud migration, a change of backup software or a change of retention should each trigger a fresh restore test.
- A written record. Note the date, what was restored, how long it took and what went wrong. The time taken is your real RTO.
What tends to go wrong in a first test is rarely the data. It is a missing encryption key, an application licence nobody can find, a restore that takes three times longer than assumed, or a dependency such as the domain controller that was never backed up. Finding these on a quiet Tuesday is the point of testing.
Perspective: what we see on the ground
We have supported Irish organisations for around 30 years, and the pattern is consistent. Firms rarely lose data because they never heard of 3-2-1. They lose time because one of the three copies was quietly failing, because the off-site copy was on the same login as everything else, or because nobody had restored anything since the system was installed.
Our advice is to make the rule boring and automatic. Backups run on a schedule, a person is told when a job fails, the off-site copy is protected by credentials that are separate from day-to-day administration, and a restore is practised until it is routine. We would also rather help a client set sensible recovery targets than sell the largest repository available, because a backup design should follow what the business can tolerate, not what is easiest to install.
If we had to give one piece of advice to a business owner reading this, it would be to ask your IT provider, whoever that is, to restore something in front of you this month. How that goes will tell you more than any report.
— Carl
How LANCAST can help
We design, run and test backup and recovery for organisations across Ireland as part of our managed services, from local backup appliances and off-site copies to disaster recovery planning and Microsoft 365 protection. Because we monitor proactively, failed jobs are noticed and dealt with before they become a problem on the day of a restore. Our managed support plans cover Silver, Gold and Platinum levels of remote and onsite support, and our data security and backup services cover backup and data recovery and disaster recovery alongside installation and cabling.
If you would like an honest review of your current backups against 3-2-1-1-0, with a test restore and a short written summary of the gaps, get in touch with our team. If you have already been hit, start with our ransomware recovery steps and our guide to a business continuity plan after a cyber attack.
FAQ
What is the 3-2-1-1-0 rule for backing up data?
It extends 3-2-1 with two requirements: one additional copy that is offline, air-gapped or immutable, and zero errors, meaning backups are verified and restores tested. The extra copy is there so that ransomware or a compromised administrator cannot delete every backup at once.
Does the 3-2-1 rule apply to photos and personal files?
Yes, the logic is identical. Keep the originals on your device, a second copy on an external drive at home, and a third copy in a cloud service or at another location. For a business, the same approach applies to staff data, but company information should follow a documented policy rather than personal habits.
How long should we keep backups?
Keep each type of data for as long as a business need or legal duty requires, and then delete it. The Data Protection Commission advises minimising retention, so do not keep everything indefinitely by default. Ask your accountant or solicitor for the minimum periods on financial and employment records, then build tiers of daily, weekly and monthly copies around them.
How often should backups be tested?
Verify every job automatically, restore sample files regularly, and run a full-system restore into a non-production environment at least once a year and after any major change. The NCSC recommends periodic drills of this kind, and the Irish SME data shows most firms test far less often than that.
Is cloud storage enough to satisfy the rule?
A single cloud copy satisfies only the off-site part. You still need a second independent copy on different media, ideally a local one for fast recovery, plus an immutable copy if you want protection against ransomware. Data held in Microsoft 365 also needs a backup outside the platform.
Sources
- Boosting your Organisation’s Cyber Resilience, ENISA (2022)
- NCSC Ireland alert on Conti ransomware (2021)
- Data Backup, Cyber Resilience Ireland
- SME Cyber Resilience: State of the Sector 2025
- Data Security Guidance, Data Protection Commission (February 2020)
- RAID capacity calculator