3-2-1 backup rule
3-2-1 · 3-2-1-1-0 · offline backup · immutable backup · air-gapped backup · backup · sauvegarde
A simple backup rule: 3 copies of your data, on 2 different types of media, with 1 kept off-site.
In practice
The 3-2-1-1-0 variant adds one offline or immutable copy (which nobody, not even an administrator, can change or delete) and “0 errors” in restore tests. The addition targets ransomware: attackers hunt down and destroy backups reachable from the network before encrypting. ANSSI therefore recommends keeping backups disconnected from the information system. Finally, a backup is only worth something if it restores: test a full restore regularly and compare its duration with your RTO and RPO targets.
Fictional case: an SME backs up every night to a storage server on the network, and every week to an external drive that is unplugged and kept off the premises. The day ransomware encrypts the servers and the network storage, the external drive lets it start again having lost six days of data, not everything.
