3-2-1-1 Backup Rule (and how to survive ransomware)
Use this page to learn the rule, then apply it based on your environment. Choose Residential or Business to see the right checklist, scenarios, and recommendations.
3-2-1-1, in plain English
Use this as your “must-haves” checklist for any backup plan:
✅ The 3-2-1-1 breakdown ▾
- 3 copies: your live data + two backup copies.
- 2 media types: different storage types or isolation boundaries.
- 1 offsite: a copy not in the same building/network.
- 1 offline or immutable: not writable by attackers during an incident.
- Offline / air-gapped = physically disconnected (or unreachable from production).
- Immutable = cannot be changed or deleted until retention expires.
Shortcut: if an attacker can reach it with the same credentials or network path, it’s not the “1”.
Why “1 offline/immutable” matters
Modern ransomware doesn’t just encrypt files—it hunts backups.
Common ways backups get destroyed ▾
- Backup target is a writable share → encrypted like everything else.
- Backup console or cloud account compromised → backups deleted.
- No MFA on backup/cloud portals.
- Backups stored in the same place as the disaster (fire/flood/theft).
Good practice: protect backup infrastructure like it’s a bank vault (even in a home).
Recommended backup approach
Choose an audience above to see the best-fit designs.
Pattern A▾
Pattern B▾
What should you back up?
This list changes slightly for residential vs business.
Priority data▾
Key vocabulary (so nobody can snow you)▾
- RPO: how much data you can lose (time).
- RTO: how fast you must be back online.
- Snapshots: helpful, but not always safe if an attacker can delete them.
- Backups: should be independent and protected (offline/immutable).
Do-this-next checklist (saves progress)
Check these off as you build or audit a backup plan.
What would you do?
Read each scenario, then expand the “best response”.
Ransomware mini-playbook (backup-focused)
These are the first steps that protect your recovery path.
Immediate actions▾
Recovery sequence▾
Quiz (score saved locally)
Answer all questions, then click Grade quiz. (Quiz matches your selected audience.)