Bottom line

3 copies, 2 media types, 1 offsite -- the classic rule still works.

Add a 4th rule for 2026: at least one copy must be immutable (append-only, WORM, or object-lock) to survive ransomware that targets your backup client.

Rotation: daily incremental local, daily offsite, weekly to immutable tier, quarterly cold/offline. The cold/offline copy is what saves you when everything else is compromised.

What is the 3-2-1 rule?

• 3 copies:
  • Your primary data plus two backups. If you only have one backup and it is corrupt, you have nothing.
• 2 media types:
  • Your primary on one type of storage, backup on another. If both are hard drives in the same machine, a firmware bug or power surge can take both out.
• 1 offsite copy:
  • Physically separate from your primary location. This is the copy that survives fire, flooding, theft, and ransomware that spreads through the local network.