Cybersecurity definition
What is 3-2-1 Backup Rule?
By Cyber Tool Stack Editorial TeamUpdated
Definition
A backup best practice: keep at least three copies of your data, on two different types of media, with one copy stored offsite. The modern 3-2-1-1-0 variant adds one offline or immutable copy and zero recovery errors — meaning restores are regularly tested and confirmed to work.
Where 3-2-1 Backup Rule fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
Immutable BackupA backup copy stored so it cannot be modified, encrypted, or deleted for a set retention period — even by an administrator account — guaranteeing a clean recovery point survives even if ransomware compromises the backup system itself.Air GapKeeping a system or backup copy physically or network-isolated from any connected system, so it can't be reached or encrypted by ransomware or other malware spreading through the network.RTO / RPORecovery Time Objective / Recovery Point ObjectiveTwo targets that define how much disaster an organization can tolerate: RTO is how long systems can be down before recovery, and RPO is how much data — measured in time — can be lost since the last good backup.RansomwareMalware that encrypts a victim's files and demands payment for the decryption key, often spreading to as many systems as possible before it's discovered.