What is the 3-2-1 backup rule for ransomware?

The 3-2-1 backup rule means keeping at least three copies of data, on two different types of storage or locations, with one copy kept offsite. For ransomware, many teams extend that model with immutable or offline copies so attackers cannot easily destroy every recovery path.

The rule improves survivability, but it does not prove recoverability. Each recovery copy still needs validation, because a backup can follow 3-2-1 perfectly and still preserve ransomware-affected data.

Last updated May 27, 2026