What Is the 3-2-1-1-0 Backup Rule?

The 3-2-1-1-0 backup rule is a data protection guideline that says you should keep three copies of your data on two different media types, with one copy offsite, one copy immutable or offline, and zero errors when you test your restores. It is the ransomware-era update to the long-standing 3-2-1 rule.

The distinction that matters most is this: the two added digits shift the rule from surviving loss to surviving an adversary. The original 3-2-1 protects against hardware failure, accident and fire. The extra 1 and the 0 assume someone is actively trying to destroy your ability to recover, and that an untested backup is not a backup at all.

What each digit means

Each digit removes a specific single point of failure.

• 3 — three copies of the data. The production copy plus at least two backups, so no single loss event takes out everything.
• 2 — on two different media or storage types. Different technologies fail in different ways, so a fault or defect affecting one does not affect both.
• 1 — one copy offsite. Geographic separation protects against fire, flood, theft and site-wide outage.
• 1 — one copy immutable or offline. A copy that cannot be altered or deleted for its retention period, whether by WORM enforcement or physical disconnection.
• 0 — zero errors on restore verification. The recovery has been tested and completed cleanly, not merely scheduled.

Why 3-2-1 stopped being enough

3-2-1 was designed for accidents. It assumes failures are random and independent, so spreading copies across media and locations makes simultaneous loss improbable.

Ransomware breaks that assumption. An attacker with stolen credentials does not fail randomly — they deliberately seek out every reachable copy. Three copies on two media in two locations offer no protection if all three are reachable from the same compromised administrative account, which is precisely what backup tampering exploits. The added 1 answers that by requiring a copy that no credential can alter. The added 0 answers a quieter failure: backups that ran successfully for years but cannot actually be restored, because nobody ever checked.

Putting the rule into practice

The digits are a checklist, but the implementation detail is where protection is won or lost.

• Make the immutable copy genuinely immutable. S3 Object Lock in compliance mode prevents deletion even by an administrator, which is stronger than a retention setting inside the backup application.
• Separate it from production identity. A logical air gap means the copy is unreachable from a compromised network, so the offsite copy is not simply another target.
• Treat the zero as a schedule, not an aspiration. Regular restore testing that proves a clean recovery is the only way to claim the zero honestly.
• Match media to recovery need. Choosing appropriate backup storage tiers keeps the fast copy fast and the long-retention copy affordable.

The 3-2-1-1-0 rule and ARTESCA

Scality ARTESCA is backup-first object storage on standard servers, and it is built to satisfy the two digits most organizations struggle with.

• The immutable 1. S3 Object Lock in governance and compliance modes, plus legal hold, enforces immutability at the object layer rather than in application policy.
• The offsite 1. Multi-site deployment and replication place a copy in a separate location without adding a separate product.
• The zero. Performance sized for recovery means restore tests can run often and at realistic scale, so verification is routine rather than disruptive.
• CORE5 protection. Five layers spanning API, data, storage, geographic and architectural levels keep the immutable copy outside the reach of a compromised production domain.

The result is a rule you can evidence rather than assert.

3-2-1-1-0 backup rule FAQs

Does the cloud count as my offsite copy?

Yes, provided it is genuinely independent. A cloud bucket reachable with production credentials satisfies the geography requirement but not the isolation intent. If the same compromised account can reach it, it is offsite but not out of reach.

Is immutable the same as offline?

They achieve the same goal by different means. Offline media such as tape is physically disconnected; immutable object storage stays online but cannot be altered or deleted within its retention window. Immutable storage is usually preferred now because it restores far faster.

What does “zero errors” actually require?

A completed test restore that produces working, verified data — not a successful backup job. Backup software reporting success only confirms data was written, not that it can come back. The zero is a claim about recovery, and only a restore can prove it.

Do I need five separate copies?

No. The digits describe attributes, not a count. A single offsite object storage copy with Object Lock can be your second copy, your offsite copy and your immutable copy at once. Three copies total, with those properties distributed sensibly, satisfies the rule.