What is the 3-2-1-1-0 backup rule?
The 3-2-1-1-0 backup rule is a data protection framework that calls for three copies of data, on two different types of media, with one copy off-site, one copy immutable or offline, and zero errors confirmed by restore testing. It extends the older 3-2-1 rule to cover attackers who deliberately delete or encrypt backups.
What does each number in 3-2-1-1-0 mean?
- 3 copies: production data plus two backups, so the loss of any one copy is survivable.
- 2 media types: two different kinds of storage, so one technology failing, such as a faulty firmware release, does not affect every copy.
- 1 off-site: a copy in another location, against fire, flood or loss of the whole site.
- 1 immutable or offline: a copy that cannot be deleted or encrypted by an attacker, either because the storage locks it or because it is disconnected from the network.
- 0 errors: restore tests that complete without errors, so the backups are known to be usable.
Why did 3-2-1 stop being enough?
The 3-2-1 rule, popularized by photographer Peter Krogh in the 2000s, was written for accidental failures: drives die, sites burn, a copy is lost. It assumes the cause of loss is indifferent to the backups. Ransomware operators are not. They search for every backup reachable from the systems they control and delete or encrypt it before encrypting production. Three copies on two media with one off-site can all be reachable from one stolen administrator login, and then every copy the rule counted is lost together.
What do the two added items change?
The first addition is a copy no login can erase: an immutable copy locked by the storage, or an offline copy disconnected from the network, which a logical air gap approximates without removable media. A lock is real only if a stolen backup administrator login cannot shorten it.
The zero is the second addition and the one most often misread. It counts errors when a backup is restored, not failures in the job log. A successful job shows that data was written. Only a restore shows that it can be read, opens in a working system and is complete. That is the work of restore testing.
Can one copy meet more than one requirement?
Yes. The rule counts roles, not devices. A single copy on locked object storage in another location is both off-site and immutable, and it still counts as one of the three copies. The rule asks that each condition is met by at least one copy in the plan, not that the plan holds five separate backups.
Frequently asked questions
Is 3-2-1-1-0 the same as 3-2-1?
No. 3-2-1 guards against loss from failures. 3-2-1-1-0 adds an immutable or offline copy and verified restores, to survive an attacker who targets backups.
Does the rule require tape?
No. Offline means disconnected from the network, which tape achieves, and immutable means locked by storage so it cannot be changed. Either meets the added condition.
How often is the zero checked?
The rule does not fix an interval. It expects restore tests to run often enough that errors are found before a real recovery.
Related terms
- Data backup: the practice the rule frames.
- Immutable backup: the first added 1, a copy that cannot be changed.
- Logical air gap: one way to keep a copy out of an attacker's reach.
- Restore testing: what the zero counts.
- S3 Object Lock: a standard way to make a copy immutable.
- Ransomware: the threat the extension addresses.