Backup: the 3‑2‑1 rule explained

This article was machine-translated from French and is being reviewed. Prices are in Algerian dinars excl. VAT.

The 3‑2‑1 rule organizes a three‑tier backup: 3 copies of your data (the original plus two backups), on 2 different media, with 1 off‑site copy (another building or cloud). It protects against disk failure, fire, or theft. Against ransomware it is not enough alone: at least one copy must be offline or immutable. This is the 3‑2‑1‑1‑0 variant, explained below.

Why 3 copies and not 2?

With the original and a single backup, a failure of the original combined with an unreadable backup loses the data. This happens: you discover a backup is unusable only when restoring it. With two backups on different media and locations, losing one copy does not block recovery. The copies also have different roles: the local one restores quickly; the remote one survives a disaster.

Example: a file server is copied nightly to a USB disk that stays plugged in (Backup A). Each week you also copy to a disk you unplug and take off‑site (Backup B). A ransomware encrypts the server, and because the plugged‑in disk is accessible, Backup A is also affected. The unplugged Backup B remains intact: you restore from it and lose at most work done since the last weekly copy.

The 2 different media: hard drive and what else?

External hard drive or SSD

Fast to write and restore, easy to set up. It is vulnerable to ransomware if it stays plugged in, and to fire, water or theft if it remains on‑site. An off‑site, unplugged disk mitigates most of these limits.

NAS (network storage)

A NAS centralizes backups from multiple workstations. Its RAID protects against a disk failure, not against deletion or encryption. Since it is network‑accessible, ransomware can reach it: use backup‑dedicated credentials and lockable snapshots if the model allows. For NAS disks, choose models designed for this use, e.g., the WD Red 6 TB, listed at 71,900 DA HT (out of stock as of 06/11/2026). See server or NAS for an SME.

Cloud (off‑site copy)

It is off‑site by nature and lends itself to automation. Two limits must be checked before committing:

• The upload speed of your connection. Sending time in hours ≈ data volume in GB × 8,000 ÷ speed in Mb/s ÷ 3,600. Example calculation: 200 GB at 20 Mb/s gives 200 × 8,000 ÷ 20 ÷ 3,600 ≈ 22 hours. The actual speed is often lower than advertised. With incremental backup, subsequent sends are shorter because only changes are sent.
• The download speed for restoration. The same calculation applies: restoring an entire server from the cloud can take hours, even days.

Measure your connection’s real speed before choosing. For personal data, also see the FAQ question about foreign cloud.

Magnetic tape

A cartridge removed from the reader is offline by nature, so it is out of reach for ransomware. However, the reader is specialized equipment and uncommon in SMEs. An external disk that is unplugged and stored offsite often serves the same purpose with less complexity.

The 3 copies: role of each

Copy 1: original data. This is the production system (server or workstations). It can fail, be deleted, or encrypted.

Copy 2: local backup. It is stored near the server and updated at a frequency tied to your data loss goal (RPO, see below). It allows quick recovery after a disk failure or user error.

Copy 3: off‑site backup. It is located away from the premises (another site, cloud, spinning disk). It protects against fire, flood, theft, and if it is offline or immutable, against ransomware.

RPO and RTO: set goals before choosing

• The RPO (Recovery Point Objective) is the maximum amount of data you accept losing, expressed in time. If your last usable backup is 24 hours old, you can lose up to 24 hours of work. RPO determines backup frequency.
• The RTO (Recovery Time Objective) is the maximum interruption time you accept before service returns. It determines the method: restoring a few files is quick, restoring an entire server is not.

There is no universal value. Ask two questions: how much does a day of data entry loss cost? how much does a day of downtime cost? The answer for a clinic, pharmacy, or shop differs from that of a small office. Write these goals in the maintenance contract.

Implement rule 3‑2‑1.

Scenario 1: small structure, limited budget

• Copy 1 : data on the PC or file server.
• Copy 2 : a daily automatic backup to an external disk or NAS on site.
• Copy 3 : a weekly copy to a second external disk, then taken off site and encrypted (e.g., with BitLocker on Windows Pro).

For 1 TB of data, budget one HDD 1 TB WD 3.5" per backup copy: 2 × 8,500 = 17,000 DA HT (price from asloitech.com on 06/11/2026, subject to availability), excluding case or USB dock and labor. Two hard drives remain one support type: if your data is modest and upload speed sufficient, an encrypted cloud copy better follows the two‑support principle.

Scenario 2: sensitive activity (clinic, pharmacy, retail)

• Example 1: the server, protected by a UPS. From 10,500 DA excl. VAT in the store (EA265 Pro 650 VA, price as of 06/11/2026, subject to availability); see UPS: how to choose the power.
• Copy 2 : a NAS or local backup server, with frequent backups to meet the RPO (several times per day for a management database) and automatic integrity checks.
• Copy 3 : an off‑site encrypted copy, in a cloud with version history and object locking if the provider offers it, or on offline rotating disks.
• Tests : a scheduled restore and a written, printed, off‑server restoration procedure.

All prices in this guide are in DA HT.

Protect the backup against ransomware

A ransomware looks for accessible backups (connected drives, network shares, NAS, synced folders) to encrypt or delete them. The U.S. cybersecurity agency CISA recommends keeping offline, encrypted backups and regularly testing their integrity. This is the idea of the 3‑2‑1‑1‑0 variant: the 3‑2‑1 rule, plus one offline or immutable copy, and zero errors during restore tests.

• Offline copy : the media is unplugged during backup hours, or stored elsewhere.
• Immutable copy (WORM, Write Once Read Many) : once written, it cannot be modified or deleted for a retention period, even by an administrator.
• Cloud with version history : a healthy previous version remains available. Protect the account with two‑factor authentication and distinct credentials, otherwise an attacker who obtains them can delete the versions.
• Separate backup account : it must not be a domain administrator nor used daily.
• Separate network : placing the NAS or backup server on an isolated network limits attack spread. See segmenting the network with VLANs.

What is not a backup

• RAID : it keeps service running after a disk failure (RAID 1 mirroring; RAID 5 tolerates one disk loss, RAID 6 two). It also instantly restores deletions, corruption or encryption.
• Synchronization (OneDrive, Google Drive, Dropbox) : it reproduces deletions and encrypted files. Version history, when available, is time‑limited.
• Microsoft 365 and Google Workspace : they host your data but do not replace an independent backup you control.

Implement 3‑2‑1 at AsloTech.

To define your backup objectives, install the solution and plan restore tests, see the computer maintenance page. For equipment (disks, UPS), consult the computer store and our professional computer hardware solution. If replacing a workstation, see repair or replace a PC. To limit access to your backups, see why a firewall in an SME.

Frequently asked questions

Also read