Resource
The 3-2-1 backup rule, RTO and RPO
Two recovery objectives drive the entire cost of protecting a business, and both are business decisions rather than technical ones. Setting them deliberately, per system rather than globally, is what keeps a backup budget sensible while still protecting the things that matter.
The rule, and what was added to it
The classic formulation is three copies, on two media types, with one offsite. Ransomware forced a fourth element.
| Element | Meaning |
|---|---|
| Three copiesOne backup failing should not mean no backup | The original plus two backups |
| Two media typesA fault affecting one type does not affect both | Different storage technologies |
| One offsiteFire, theft, flood or regional event | Geographically separate |
| One immutableModern ransomware targets backups first | Cannot be altered or deleted for a set period |
| Restore testedAn untested backup is an assumption | Proven recoverable on a schedule |
Setting recovery objectives
Recovery time objective is how long you can be down. Recovery point objective is how much data you can afford to lose. Both drive cost directly.
- Set them per system, not globally. A file share and a transactional database do not need the same protection
- Involve the department that uses the system, since only they know the real tolerance
- Cost each tier, because an hour of tolerance costs far more to deliver than a day
- Write the agreed numbers into the agreement rather than leaving them assumed
- Review after any material change to the business or the systems
Why offsite needs defining
Offsite frequently means a different building, which addresses fire and theft and nothing else.
For a business in this region the meaningful question is which seismic zone the recovery copy sits in, because a copy 20 miles away satisfies most compliance checklists and provides no protection against the regional event that dominates planning here.
Moving a recovery copy to a genuinely separate region is usually a configuration change rather than a project. Ask your provider which region holds your copy. If the documentation is any good it takes a minute to answer.
Common questions
Answered before you ask.
Does cloud storage count as offsite?
It depends on the region. A backup replicated within the same geographic region is offsite in the sense of being in another building, which handles local failures. For regional risks, the copy needs to sit in a genuinely different area, and a great many businesses have never checked which region theirs is in.
How often should restores be tested?
Continuously as part of normal operation rather than as an annual exercise. Automated restore verification on covered systems means a failure surfaces within a day instead of during an emergency. A full recovery rehearsal involving people and process is worth doing annually on top of that.
What does immutable actually mean?
A backup that cannot be modified or deleted for a defined retention period by anyone, including an account with full administrative rights. That last part is the point, because by the time ransomware triggers the attacker usually holds exactly those rights and will target the backup system first.
Related
Read next.
Backup and disaster recovery
Immutable backups with tested restores and a defined recovery window.
Disaster recovery for Pacific Northwest businesses
Cascadia, windstorms and wildfire smoke, and why a recovery site 20 miles away is not separation.
Ransomware protection for small business
How attacks actually start, which controls stop them, and what to do in the first hour.
What is included in managed IT services
A line by line scope, including the exclusions most contracts hide.
Cloud services and migration
Azure, hybrid environments and planned server retirement.
Start with the assessment, not the contract.
We document what you have, test whether your backups restore, and give you the findings in writing. Yours to keep either way.