The 3-2-1-1-0 rule, digit by digit
The rule broken down
| Digit | Requirement | What it protects against |
|---|---|---|
| 3 | Three copies of the data | Failure of one medium |
| 2 | On two different media types | Systemic defect in one technology |
| 1 | One copy off site | Physical disaster at the site |
| 1 | One immutable or offline copy | Ransomware, compromised administrator, mass human error |
| 0 | Zero errors on restore verification | The illusion of a backup that does not restore |
The first three digits are the classic rule. The last two were added in response to modern ransomware, which explicitly targets backup infrastructure before encrypting production.
Immutability
An immutable backup cannot be modified or deleted for a defined period, including by an administrator with full rights. That last clause is what matters.
Three common implementations:
- Object lock on compatible storage, with a compliance-mode retention period;
- Offline tape, physically disconnected — the most robust protection, the slowest to restore;
- Remote repository with separate authentication, on infrastructure whose administration does not depend on the production directory.
Isolating the administration domain
This is the most frequently mishandled point. A backup stored on a server joined to the same directory as production, administered with the same accounts, falls with production.
Three principles:
- Separate accounts — the backup administrator is not the production domain administrator, and their compromise does not follow from the domain's;
- Independent authentication — ideally a separate directory or hardened local authentication;
- One-way flow — production pushes to backup; backup does not allow itself to be queried or driven from production.
The "0": verify the restore, not the backup
A "successful" backup report attests that data was written. It does not attest that it is restorable, consistent and usable.
The expected verification has three levels:
- Automatic and frequent: restore a sample of files, daily;
- Functional and periodic: restore a complete database into an isolated environment, with application-level checks — monthly or quarterly;
- Complete and annual: restore an entire service end to end, measuring actual duration.
DORA Article 12 explicitly requires that restoration systems be periodically tested and that backups be physically and logically separated from the source system. An undocumented restore test does not meet the requirement.
Key takeaways
- The extra first "1" is immutability: that is what resists ransomware
- The "0" requires verifying a restore, not verifying a backup
- A backup in the same authentication domain as production is not isolated