Backups are the last line of defence against data loss, whether from failure, error or ransomware. The 3-2-1 rule has long been the simplest yardstick for whether a backup deserves the name.
The rule
Three copies: the production data and two backups. Two different media or systems, so a single fault does not hit every copy. One copy at another location, so fire, water or theft cannot destroy everything.
The extension against ransomware
Attackers deliberately look for backups and delete or encrypt them before the actual attack. The 3-2-1-1-0 rule therefore adds a copy that is immutable or offline, meaning it cannot be deleted even with admin rights, and a zero for error-free restore tests.
Do not forget cloud services
Data in Microsoft 365, Google Workspace or SaaS applications is not automatically backed up in the sense of the rule. Providers back up their operations, not necessarily your deleted mailbox or overwritten folder. Business-critical cloud data needs its own backup or at least a verified retention rule.
Only tested backups count
The most common gap is a backup whose restore was never tested. A quarterly test in which a system is actually restored shows whether RPO and RTO targets are achievable. The result should be documented, also for the TOMs.