3-2-1 Backup Rule Explained, and Why 3-2-1-1-0 Exists
The 3-2-1 backup rule says you keep three copies of your data, on two different types of storage media, with one copy off-site. Ransomware added two digits: the 3-2-1-1-0 rule asks for one immutable or offline copy and zero errors when you test a restore.
TL;DR:
- 3-2-1 means three copies (the original plus two backups), two media types, and one copy kept somewhere else.
- The rule is usually credited to photographer Peter Krogh's The DAM Book, and CISA still calls it "a trusted guideline."
- 3-2-1-1-0 is Veeam's extension: one immutable or air-gapped copy, plus zero recovery errors in tested restores.
- CISA's ransomware guidance points the same way: keep offline, encrypted backups and test them regularly.
- AIOZ Storage works as the off-site cloud copy. Its docs don't list Object Lock, so plan the immutable copy elsewhere.
Updated Oct 19, 2026: added where the rule comes from, a 3-2-1-1-0 diagram, CISA's ransomware backup guidance, an immutable vs offline comparison, and a restore test you can run against AIOZ Storage.
What Is the 3-2-1 Backup Rule?
Backblaze breaks the rule into three parts. Three: "your three copies include your original data... plus two more copies." Two: "you should store your data on two different storage media, such as a local drive and a cloud storage service." One: "you should keep one copy of your data off-site in a remote location."
Each number guards against a different failure, and three copies cover a backup job that silently failed. Two media types cover a flaw that hits one kind of storage. The off-site copy covers a fire, flood or theft that takes out a whole building.
Where Does the 3-2-1 Backup Rule Come From?
CISA's 2012 paper "Data Backup Options" tells you to "follow the 3-2-1 rule." Its footnote names the source as Peter Krogh's The DAM Book: Digital Asset Management for Photographers, 2nd edition (O'Reilly, 2009), page 207. That matches Backblaze's note that the rule was "first introduced in the late aughts."
The rule outlived the photography book it came from, and CISA's small-business backup page still says "The 3-2-1 rule is a trusted guideline," and its water-sector fact sheet tells operators to "Implement the NIST 3-2-1 rule." Backblaze calls it "the de facto standard for data redundancy."
Why Each Number Matters
Three copies
A single backup fails the moment that backup fails, and backups fail more often than people expect. A job writes incomplete data, a drive corrupts, or someone deletes the wrong folder. With the original plus two backups, you can lose one backup and still restore from the other.
Two different media
Two backups on the same kind of storage can die from the same cause, such as a firmware bug in one drive model or an outage at one provider. Backblaze's example pairs a local drive with a cloud service because their failure modes barely overlap.
One copy off-site
A second drive in the same room survives a disk failure, but not a fire or a burglary. Off-site means a different building, region or provider, and it's the part people skip most, because you can't meet it by buying another hard drive.
What Is the 3-2-1-1-0 Backup Rule?
The original rule assumes that any copy you can reach is a copy you can trust. Ransomware breaks that assumption, because attackers go after the backups too. Veeam says "the original 3-2-1 rule wasn't designed with ransomware, immutable storage, or public cloud in mind," and that ransomware "increasingly targets backups."
Veeam's 3-2-1-1-0 rule keeps the first three digits and "adds one immutable copy and verifies zero recovery errors." The extra 1 is a copy that an attacker with valid credentials still can't change or delete, either because it's immutable for a retention period or because it's offline. The 0 means you've test-restored and every restore came back clean. Veeam's reasoning: "a backup only matters if you can count on it to restore when it's needed."
CISA Ransomware Backup Guidance
CISA doesn't use the 3-2-1-1-0 name, but its advice covers the same two digits. The #StopRansomware Guide tells you to "Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario." That is the extra 1 (offline) and the 0 (tested) in plain words.
Recent advisories go further: CISA's 2026 advisory on the Gunra ransomware tells you to "Implement and test offline, immutable backups stored in a physically separate, segmented location." If you write a backup policy for an auditor, quoting CISA carries more weight than quoting a vendor's rule name.
Immutable vs Offline Backups
Both meet the extra 1, but they work differently and cost you different things.
| Immutable copy | Offline (air-gapped) copy | |
|---|---|---|
| How it's protected | storage refuses changes or deletes until a retention date | no network path to it at all |
| Example | S3 Object Lock in compliance mode | tape or a drive in a safe |
| Restore speed | fast, it's online | slow, someone fetches it |
| Main risk | a retention setting that's too short | a copy that's out of date |
Our explainer on Object Lock and WORM storage covers the retention modes in detail. Many teams keep both: an immutable cloud copy for fast recovery and an offline copy for the worst day.
How AIOZ Storage Handles It
AIOZ Storage fits the off-site, second-media leg, since it's S3-compatible cloud storage on a decentralized network, a different provider and failure domain from your local disk or NAS. Inside the network, built-in erasure coding spreads each encrypted object across many nodes, which our redundancy explainer covers. That protects against node failure, not against a delete you make yourself.
What the docs don't cover yet: Object Lock, retention periods or object versioning. So AIOZ Storage can be your third copy, but the immutable "+1" has to come from another tier for now.
You can work on the 0 today: upload a backup, pull it back, and compare hashes, using the AIOZ docs' CLI commands:
# Recent AWS CLI versions: send Content-Length (see our CLI quickstart)
export AWS_REQUEST_CHECKSUM_CALCULATION=WHEN_REQUIRED
aws s3 --endpoint-url https://s3.aiozstorage.network cp ./backup-2026-10-19.tar.gz s3://bucket-name
aws s3 --endpoint-url https://s3.aiozstorage.network cp s3://bucket-name/backup-2026-10-19.tar.gz ./restore-test.tar.gz
sha256sum backup-2026-10-19.tar.gz restore-test.tar.gzIf the two hashes match, that restore had zero errors. Run it on a schedule, for example with a GitHub Actions backup job.
Next step: the AIOZ Storage CLI docs list every bucket and object command.
Frequently Asked Questions
What does the 3-2-1 backup rule mean?
Keep three copies of your data, on two different types of storage media, with one copy off-site.
Who created the 3-2-1 backup rule?
CISA's "Data Backup Options" paper credits photographer Peter Krogh's The DAM Book (2nd edition, 2009). Backblaze dates it to the late 2000s, and it has held up since.
What is the 3-2-1-1-0 rule?
Veeam's extension of 3-2-1: the same three copies, two media and one off-site copy, plus one immutable or air-gapped copy and zero errors in tested restores.
Does CISA recommend the 3-2-1 backup rule?
Yes. CISA's small-business guidance calls it "a trusted guideline," and its ransomware guidance adds offline, encrypted backups that you test regularly.
What is an immutable backup?
A copy the storage system won't let anyone change or delete until a retention date passes, even with valid credentials. S3 Object Lock in compliance mode is a common example.
Is a cloud copy enough for the off-site rule?
Yes, if it's with a different provider or region than your primary data. For the ransomware digit you also need that copy, or another one, to be immutable or offline.
Does AIOZ Storage satisfy the 3-2-1 backup rule?
It can be your off-site, different-media copy. Its docs don't list Object Lock or versioning, so the immutable copy in 3-2-1-1-0 needs another tier.
Related Reading
- What Is S3 WORM Storage? Object Lock Modes and Setup - the storage-enforced immutability the extra 1 calls for.
- What Is S3 Object Versioning and How Does It Work? - the mechanism under Object Lock, and a recovery path for overwrites.
- What Is Data Replication in a Distributed System? - why copies on many nodes still aren't a backup.
- How AIOZ Storage protects your objects - what built-in erasure coding covers, and what you still back up yourself.
- Data Durability vs Availability, and What 11 Nines Means - what durability numbers do and don't promise for one copy.
- Automating Backups to AIOZ Storage with GitHub Actions - a scheduled off-site copy.
- Multi-Cloud Storage Disaster Recovery with AIOZ and S3 - two live copies kept in sync across providers.
- How to Use AIOZ Storage Effectively: A Practical Checklist - versioning workarounds and other habits for AIOZ Storage.
- What Is AIOZ Storage? S3-Compatible Decentralized Storage - what AIOZ Storage is overall.
References
Related Content
What Is Distributed Storage? How It Works, With Examples
Distributed storage keeps data on many independent nodes that act as one system. See how it works, replication vs erasure coding, its types and trade-offs.
What Are Egress Fees? How Download Charges Work in Storage
Egress fees are charges for data leaving a storage provider's network. See what triggers them, how to estimate them, and what AIOZ Storage's docs say.
Object Storage Vector Database: Where AIOZ Storage Fits
An object storage vector database keeps vectors in the storage layer, not a cluster. See how it differs, when to pick it, and where AIOZ Storage fits in.
AIOZ Storage Vector Database Pricing: What You Pay For
AIOZ Storage vector database pricing line by line: upload, storage, queries, data searched and data returned, with a worked monthly example you can reuse.
How to Create a Bucket and Upload a File on AIOZ Storage
Create a bucket and upload a file on AIOZ Storage in five steps: sign up, set a passphrase, add credits, and upload. Plus what the passphrase cannot recover.
AIOZ Storage Rate Limit: Working Within 100 Requests/s
The AIOZ Storage rate limit is 100 requests per second. See what the docs do and don't say, and how to stay under it with boto3 retries and a limiter.