The 3-2-1 Backup Rule and the 3-2-1-1-0 Strategy
Three copies, two media, one off-site. Then one copy attackers cannot change, and zero errors on verification. We check all five.
The extra 1 is the copy ransomware cannot touch
An offline, air-gapped or immutable copy is what turns a ransomware attack into a restore instead of a ransom.
The 0 means verified, not assumed
Backup verification and restore tests prove the copies are usable before you need them.
What the 3-2-1 backup rule means for a business
The 3-2-1 backup rule keeps three copies of important data, on two different types of storage, with one copy off-site. Many vendors now extend it to 3-2-1-1-0: one copy offline, air-gapped or immutable, and zero errors after backup verification.
The rule is a minimum, not a design. It says nothing about how often you back up, how long you keep copies, or how fast you can restore, which is why the audit pairs it with your RPO and RTO targets.
Background: Veeam, the 3-2-1 backup rule.
How each part of 3-2-1-1-0 is checked
| Part | What it means | What we look for |
|---|---|---|
| 3 copies | Production data plus two backups | Two independent backup copies of every critical system |
| 2 media | Two different storage types or platforms | For example a local repository and cloud object storage, not two folders on one NAS |
| 1 off-site | One copy in another location | Another site, cloud region or account, with a tested restore path |
| 1 offline or immutable | One copy attackers cannot change or delete | Object lock, hardened repository, offline media or vendor equivalent |
| 0 errors | Verified backups and tested restores | Automatic verification results and restore test records |
What we look for and why
Copies on one platform are one copy
Two backup jobs writing to the same NAS share fail together. We look at where each copy physically and logically lives.
Off-site must be restorable
A cloud copy you cannot download in time does not meet your RTO. We check bandwidth, egress and restore paths.
Retention is part of strategy
If an attacker sits undetected for weeks, short retention means every copy is already infected. We compare retention with realistic dwell times.
A finding from the sample report
- Area
- Backup architecture
- Finding
- Both backup copies stored on the same NAS
- Severity
- High
- Evidence
- Nightly backups and the weekly “off-site” job both write to NAS01 in the server room. The weekly job copies to a second share on the same device. No cloud or offline copy exists.
- Fix
- Add an off-site copy in a separate cloud account with immutability enabled, keep the local copy for fast restores, and document the restore path from each copy.
Every finding in the real report has this shape. See the full sample report
A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Where to go next
Immutable and air-gapped backups
The “1” that ransomware cannot touch.
Want a quick self-check first? Backup and disaster recovery self-assessment · Ransomware recovery cost estimator
Page 2 of 16: Backup strategy: 3-2-1 and 3-2-1-1-0
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0 (this page)
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
Is the 3-2-1 rule still enough?
It is a good minimum, but on its own it does not protect against ransomware that deletes or encrypts every reachable copy. That is why most guidance now adds an offline or immutable copy and verified restores (3-2-1-1-0).
Does cloud sync count as a backup copy?
Usually not. Sync services such as OneDrive or Dropbox replicate deletions and encryption. A backup copy must be separate, versioned and restorable to a point in time.
Do you change anything in our backup system?
No. The audit is read-only. We review settings, job history and documents through a read-only role or a screen-share with your administrator. We never change, delete or run backup jobs.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Find out whether your backups meet 3-2-1-1-0
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.