Many organisations discover their backups don’t work at the worst possible moment. The 3‑2‑1‑1‑0 rule is a simple way to check yours.
- 3 copies of your data — production plus two backups.
- 2 different types of storage — for example a backup appliance and cloud storage.
- 1 copy off‑site, so fire, theft or flooding can’t take everything.
- 1 copy immutable or offline, so ransomware and rogue admins can’t delete or encrypt it.
- 0 errors when you test a restore.
Don’t forget
- Cloud apps need backing up too. Microsoft 365 and Google Workspace keep your data available, but recovering from accidental or malicious deletion often needs a separate backup.
- Define RPO and RTO. How much data can you afford to lose, and how fast must you be back? Those answers set backup frequency and recovery design.
- Protect the backup system itself with separate credentials and multi‑factor authentication.
- Test regularly — restore files, full servers and, at least once a year, a full disaster‑recovery scenario.