The rule itself
3-2-1 means: keep at least 3 copies of your data, on at least 2 different types of storage media, with at least 1 copy stored off-site. It's old advice (it predates cloud storage), but it still holds up because it protects against the actual ways backups fail: hardware failure, a corrupted drive, and a site-level disaster (fire, theft, a ransomware attack that encrypts everything it can reach, including attached backup drives).
Where real setups usually fall short
In practice, the gap is almost always one of these:
- Only 2 copies exist: the production data and one backup, with no second independent copy
- The backup lives on the same physical infrastructure as production, so a single incident takes out both
- There's no off-site copy at all, which means a site-level disaster (or ransomware that reaches attached storage) takes everything
- Backups are scheduled but never tested, so nobody actually knows if a restore works until they need it to
The part most setups skip: testing restores
A backup that's never been restored isn't a verified backup, it's an assumption. Corrupted backup files, permission issues that only show up on restore, and incomplete backup scripts that silently miss a directory are all common, and all invisible until the moment you actually need the backup. A scheduled restore test, quarterly at minimum, is the difference between a backup strategy and a backup habit.
Retention and RTO/RPO, briefly
3-2-1 covers where backups live, not how much history you keep or how fast you can recover. Retention policy (how far back you can restore from) and RTO/RPO (how long recovery takes, and how much data you can afford to lose) are the next layer, and they should be sized to what the business actually needs, not a generic default. A documented recovery runbook that spells out the actual steps, not just 'restore from backup,' is what turns disaster recovery from a plan into something that works under pressure.