The 3-2-1-1-0 Backup Rule for the Ransomware Era

For years, 3-2-1 was the gold standard for backup. Ransomware forced an update: 3-2-1-1-0 adds an offline or immutable copy and a requirement for zero recovery errors.

Breaking it down

• 3 copies of your data.
• 2 different types of storage media.
• 1 copy off-site.
• 1 copy offline, air-gapped or immutable.
• 0 errors, verified through automated recovery testing.

Why the extra 1 and 0 matter

Attackers target online backups. An immutable or air-gapped copy survives even if credentials are stolen. And untested backups are just assumptions — the zero means you have proven recovery works.

Applying it in hybrid and cloud estates

The off-site copy may be in a second region or cloud account; the immutable copy may be object-lock storage or a hardened repository. Map each workload to all five numbers.

A worked example

Consider a mid-size company running VMware workloads and Microsoft 365. A 3-2-1-1-0 design might look like this: primary backups on a deduplicating appliance on-site; a replicated copy to a second site or cloud region; an immutable copy in object storage with object lock; and Microsoft 365 data backed up by a separate SaaS backup service outside the tenant.

Automated verification boots a sample of VMs from backup every week, and a quarterly test restores a full application end-to-end. The “zero” is reported monthly to IT leadership alongside backup success rates.