The 3-2-1 Backup Rule Explained

The 3-2-1 Backup Rule Explained

Photo by Jakub Zerdzicki on Pexels

The 3-2-1 rule is the gold standard of backup strategy. It's simple, battle-tested, and recommended by every major IT organization from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to Veeam. Here's what it means:

The Rule Breakdown

• 3 copies of your data — the original plus two backups. If one copy fails, you still have two.
• 2 different media types — e.g., an external hard drive and cloud storage, or NAS and tape. Different media fail differently, so a single defect won't kill all copies.
• 1 copy off-site — stored in a different physical location (cloud, remote office, or a safe deposit box). If your building burns, floods, or is burglarized, the off-site copy survives.

Why Three Copies?

With two copies (original + one backup), a single failure leaves you with zero redundancy. With three copies, you can lose any one and still have two remaining. The probability of two independent copies failing simultaneously drops dramatically.

Why Two Media Types?

Storage media share failure modes. A bad batch of hard drives from the same manufacturer might fail together. By using different media (e.g., HDD + cloud, or HDD + tape), you avoid common-mode failures.

Why Off-Site?

A fire, flood, or theft can destroy every device in your office. The off-site copy is your insurance against physical disasters. Cloud storage is the easiest off-site destination for most businesses.

Step-by-Step: Implementing 3-2-1 with Free Tools

Here's a practical 3-2-1 setup you can build today:

1. Copy 1 (Original): Your data on your server or workstation.
2. Copy 2 (Local backup): Use Duplicati or BorgBackup to back up to an external USB drive or NAS nightly.
3. Copy 3 (Off-site backup): Use Duplicati or Restic to encrypt and push the same data to a cloud destination (Backblaze B2 at $6/TB/month, or Wasabi at $6.99/TB/month, or even Google Drive's 15GB free tier for small datasets).

Sample BorgBackup Script (Copy 2 – Local)

# Create local backup with Borg
export BORG_REPO=/mnt/usb/backup
borg create --stats --compression lz4 \
  $BORG_REPO::'{hostname}-{now}' \
  /home /var/www /etc

# Prune: keep 7 daily, 4 weekly, 6 monthly
borg prune -v $BORG_REPO \
  --keep-daily=7 --keep-weekly=4 --keep-monthly=6

Sample Restic Script (Copy 3 – Off-site)

# Push encrypted backup to Backblaze B2
export B2_ACCOUNT_ID=YOUR_ID
export B2_ACCOUNT_KEY=YOUR_KEY
export RESTIC_PASSWORD_FILE=/root/restic.pwd
restic -r b2:mybucket:backup backup /home /var/www /etc
restic -r b2:mybucket:backup forget --keep-daily 7 --keep-weekly 4

Key Takeaways

• 3 copies, 2 media types, 1 off-site — this is the minimum acceptable backup strategy.
• Use free tools like BorgBackup (local) and Restic (off-site) to implement it.
• Different media types protect against common-mode failures.
• Off-site copies protect against physical disasters — cloud is the easiest option.