The 3-2-1 backup rule says to keep 3 copies of data on 2 different media types, with one copy off-site. CISA's backup guide calls for one primary and two backups on two kinds of media "to protect against different types of hazards," with one of them off-site.
CISA credits the idea to Peter Krogh's The DAM Book, a guide written for photographers. Modern versions such as 3-2-1-1-0 add an immutable copy and routine test runs on top.
What is the 3-2-1 backup rule?
Each number protects your data from a different threat, so there's no single point of failure. Skip one, and the other two can't fully cover for it.
- 3 copies: your live data plus two backups, so if one is corrupted, you still have a good one.
- 2 types of media: for example a local disk or NAS plus cloud object storage, so one hardware failure or software fault can't cause total data loss.
- 1 off-site backup: one stored in another building, region or account. Fires, floods and other natural disasters can't reach it, and neither can a break-in at the office.
A third copy can feel like overkill until the day one of them is bad. That spare is the redundancy that keeps your data safe when a backup fails.
What does the 3-2-1-1-0 rule add?
Veeam extended it to 3-2-1-1-0 because ransomware now targets backup systems as well as live data. The extra 1 is a copy that's immutable or air-gapped, so a ransomware attacker who gets onto your network can't change or delete it.
The 0 stands for zero errors when you test a restore. A backup you've never restored is a guess, and this step proves your data comes back intact.
AWS Backup now offers a vault built for this. It stores immutable backups that are locked by default and isolated with encryption.
How to implement the 3-2-1-1-0 rule
Start from a working 3-2-1 setup and add two things. First, make at least one copy unchangeable with write-once storage, or keep it offline on a drive that's disconnected between jobs.
Then put recovery tests on the calendar. Restore to an isolated environment, check that records open, and keep a log of each result for your next audit.
How to implement a 3-2-1 backup strategy
The setup works the same way for a small business and a large organization. What changes is how much data you hold, how often it changes and how much a data loss would cost.
- List the data you can't afford to lose: databases, business files, server and system settings, and the SaaS apps your teams use every day.
- Pick two types of storage media: a local or external drive or NAS for quick recovery, and cloud object storage for the off-site backup. Our guide to data backup methods covers the options.
- Keep that backup in a different location, account or region from production, with its own login. Our cloud backup best practices also call for one copy kept off-site.
- Automate the jobs and match the schedule to how fast your data changes, from daily for customer records to monthly for files that rarely move.
- Encrypt your backups in transit and at rest, and put multi-factor authentication on every account that can reach them for extra security.
- Test recovery on a schedule, and replace aging drives before they crash or fail.
Common mistakes when following the 3-2-1 rule
A backup strategy can look right on paper and still let you down on the day you need it. These are the gaps to check for.
- Treating sync as a backup. CISA warns that rolling backups "can silently propagate any corruption or malware in the primary files to the backup files."
- Putting everything behind one admin login, so an attacker holding those credentials can reach every copy. A ransomware backup strategy keeps one out of reach.
- Never testing recovery. Silent errors only show up when you try to restore, and that's the worst time to find them.
- Keeping backups for too short a period, or without multiple versions. If corruption happens and nobody spots it for three weeks, you need a version from before it started.
- Leaving SaaS data out. Records in apps like Salesforce need protection of their own, as the next sections explain.
Can you use only cloud storage to meet the 3-2-1 rule?
Yes, as long as the copies are kept apart. CISA lists cloud storage as a remote backup option, and Veeam counts a public cloud as an off-site location.
What doesn't count is three copies in one account with one cloud provider, where a single outage or stolen login can reach them all. Keep the off-site backup in its own account, region or provider, with a separate login.
Pulling a large dataset back over the internet can also take a while. A local copy on a physical disk is still worth having when you need data back fast.
Do SaaS apps like Salesforce need 3-2-1 backups?
Yes. Salesforce's built-in safety nets are short-lived: deleted records stay in the Recycle Bin for 15 days before they're permanently deleted, as our post on Recycle Bin retention covers.
The Data Export Service runs weekly at most, or every 29 days on Professional and Developer Editions. Its zip files are deleted 48 hours after Salesforce emails you the link, so someone has to download and store each one.
That leaves you a single export at best, saved as a zip archive of CSV files. Treat Salesforce like any other system in your disaster recovery plan, with production as the original and two more copies, one of them off-site.
How Flosum brings 3-2-1 backups to Salesforce
Flosum Backup & Archive runs scheduled, incremental and high-frequency backups of Salesforce data and metadata. You can restore to field, record or full-org level from a point in time.
Backups are stored apart from Salesforce's own infrastructure, which gives you the off-site copy. For the wider plan, see our Salesforce backup best practices and backup and recovery strategy guides.
Flosum offers three deployment options: Salesforce-native, Flosum-hosted cloud and customer-hosted. Backup & Archive runs as a Flosum Cloud App, either Flosum-hosted on Flosum-managed AWS or customer-hosted on your own AWS, Azure or GCP.
A hybrid option writes backups to your own S3 bucket or Azure Blob container. With customer hosting, Flosum never holds your data or your keys.
FAQs
What is the 3-2-1 backup rule?
It's a data protection strategy that keeps three copies of your data, the original and two backups, on two different media types, with one kept off-site. CISA recommends it for home users and businesses alike.
Who came up with the 3-2-1 backup rule?
CISA credits it to Peter Krogh's The DAM Book: Digital Asset Management for Photographers. CISA's guide recommends it to all computer users, from home users to professional information security officers.
What is the 3-2-1-1-0 backup rule?
It's Veeam's extension of the original. It adds one backup that's immutable or air-gapped, so ransomware can't change it, and zero recovery errors when you test restores.
Is cloud storage enough to meet the 3-2-1 rule?
It can be, if the copies sit in separate accounts, regions or providers. Keeping everything in a single cloud account doesn't qualify, because one outage or one stolen login can reach it all.
Does Salesforce back up my data?
Salesforce's Recycle Bin keeps deleted records for 15 days and its Data Export Service runs weekly at most, but neither is a tested backup you can restore in one step. Salesforce sells Backup & Recover as a paid add-on, or you can use a third-party Salesforce backup solution.
How often should you test backups?
Test recovery on a set schedule and after any big change to your systems or backup setup, in an isolated environment, and check that every record came back. The 0 in 3-2-1-1-0 sets the target at zero recovery errors, so fix any failed restore before the next test.
Book a demo to see how Flosum Backup & Archive keeps encrypted copies of your Salesforce data outside Salesforce.
Thank you for subscribing
