---
title: "The 3-2-1 Backup Strategy, Done Properly: Snapshots, Offsite and Cloud Copies"
url: "https://www.iopstor.com/blog/3-2-1-backup-strategy"
type: "Blog"
published: "2026-10-29"
updated: "2026-10-29"
description: "The 3-2-1 backup rule, explained properly: how snapshots, a second copy and an offsite or cloud copy work together to survive ransomware, fire and mistakes."
---

# The 3-2-1 Backup Strategy, Done Properly: Snapshots, Offsite and Cloud Copies

The 3-2-1 backup rule, explained properly: how snapshots, a second copy and an offsite or cloud copy work together to survive ransomware, fire and mistakes.

Every business says it has backups. Far fewer can say how long a full restore would take, when they last tested one, or whether those backups would survive the same ransomware that just encrypted the server.

The 3-2-1 rule has been the standard answer for about twenty years. It still works, but only when it's done properly. Here is what “properly” looks like in 2026.

## What the 3-2-1 rule actually says

|  |  |  |
| --- | --- | --- |
| 3 | copies of your data | The live data plus two backups. One copy is a single point of failure, and two can fail together. |
| 2 | different types of storage | Not two folders on the same server. Use a second device, a different array, tape or the cloud, so one fault can't take out both. |
| 1 | copy offsite | In another building, another city or the cloud, so a fire, flood or theft at the office can't reach it. |

**No single event should be able to destroy every copy at once.**

That covers a dead disk, a deleted folder, a burst pipe and a ransomware attack alike.

## Why it matters more now, not less

- **Ransomware goes after backups first.** In Sophos' *State of Ransomware 2024*, 94% of organisations hit by ransomware said the attackers tried to compromise their backups as well. A backup on a mapped drive, or one that shares the server's admin password, gets encrypted with everything else.
- **Disks still fail.** Bigger disks take longer to rebuild, and a second failure during a rebuild is exactly when an array is at its weakest.
- **People delete things.** Most restore requests in an ordinary office are for a file someone deleted or overwrote, not for a disaster.
- **The building is a risk too.** A flooded basement in the monsoon, a fire in the server room or a stolen NAS takes every copy in the room with it.
- **The law now cares.** Under India's Digital Personal Data Protection Act, 2023, losing access to customers' personal data can itself count as a personal data breach.

## Snapshots are not backups, but they are your first line

A snapshot is a read-only picture of your data at a moment in time. On ZFS, the file system every IOPStor appliance runs on, taking one is instant and costs almost no space, because it only records the blocks that change afterwards. You can keep hundreds of them (hourly for a day, daily for a month, monthly for a year) and roll a file, a share or a whole volume back in seconds.

Snapshots are read-only, so ransomware that encrypts your files can't rewrite the snapshot underneath them. Ransomware that gets admin access to the storage itself is a different story, and that is why the next two copies exist.

What a snapshot can't do is outlive the system it sits on. It shares the same disks, the same box and the same room. If the pool fails, or someone with the admin password deletes it, the snapshots go too.

**Snapshots are the safety net for copy one. They are not copies two and three.**

## 3-2-1, done properly: a layout that works

### Copy 1: production data, with scheduled snapshots

## 


| Label | Value |
| --- | --- |
| Take a snapshot | Keep |
| Every hour | 24 |
| Every day | 30 |
| Every week | 12 |
| Every month | 12 |

**Databases and virtual machines often warrant every 15 minutes.**

### Copy 2: a second system, replicated

ZFS can send just the blocks that changed since the last snapshot to a second appliance, in another rack, on another floor or, better still, at another site. Only the changes travel, so replicating every 15 minutes or every hour works even over an ordinary business line. If the main system fails, the second one already holds your data and its snapshot history.

### Copy 3: offsite or in the cloud

This copy lives somewhere a bad day at the office can't reach: a branch office, a data centre, or S3-compatible object storage in the cloud. It needs two things:

- **Separate credentials.** An attacker who takes over your domain admin account should not be able to sign in to your backups.
- **Immutability, where you can get it.** Use object lock or a retention period that nobody, including you, can shorten.

THE 2026 UPGRADE: 3-2-1-1-0

## Add a 1 and a 0

Many teams now extend the rule to 3-2-1-1-0.

- +1: one copy that is immutable or offline. An attacker can't encrypt or delete what can't be changed or reached.
- +0: zero errors when you restore. A backup you have never restored is a hope, not a backup.

## Six mistakes that quietly break 3-2-1

- Treating sync as backup. OneDrive, Google Drive and Dropbox copy your mistakes too, including deletions and encrypted files. Version history helps, but it is not a separate, independent copy.
- Calling RAID a backup. RAID keeps you running when a disk dies. It does nothing about a deleted file, a corrupt database or ransomware, and it will faithfully store all three.
- A USB drive that's always plugged in. If the server can see it, so can ransomware.
- One password for everything. Keep backups behind separate accounts, with two-factor sign-in.
- Never testing a restore. Otherwise you find out a backup job has been failing silently on the day you need it.
- Too little history. Ransomware and corruption can go unnoticed for weeks, and seven days of snapshots won't reach back far enough.

## A 30-minute restore test you can run this month

- Pick one real file, one shared folder and one virtual machine or database.
- Restore each one from a snapshot, and time it.
- Restore the same three from your offsite or cloud copy, and time it.
- Open what came back. A file that restores but won't open hasn't really been restored.
- Write down how long it took. That is your real recovery time, whatever the brochure says.

Repeat it every quarter, and after any change to your storage.

## Where IOPSTOR fits

Every IOPSTOR appliance is built on ZFS, so copy one comes with unlimited snapshots, end-to-end checksums that catch silent corruption, and self-healing pools. We size and set up the rest of the layout with you:

- Replication to a second IOPStor at a branch or DR site
- An S3 bucket for the offsite copy
- AWS integration for disaster recovery
- Disaster Recovery as a Service

It is priced once, with no software licence renewals. [See how our NAS handles snapshots](https://www.iopstor.com/services/storage/nas)

## Frequently asked questions

### Is RAID a backup?

No. RAID protects you from a failed disk. It copies deletions, corruption and encrypted files just as faithfully as good data.

### Are snapshots enough on their own?

No. They sit on the same system as your data. They make restores fast, but they need a second system and an offsite copy behind them.

### How often should we take snapshots?

Hourly during working hours is a good default for file shares. Databases and virtual machines often need every 15 minutes.

### How long should we keep backups?

At least 30 days of daily history, so you can reach back past ransomware that sat quietly before it struck. Keep monthly copies for a year if audits or disputes ever need old records.

### Is cloud backup enough as the offsite copy?

Yes, as long as it uses a separate account, is immutable where possible, and you know how long a full restore takes over your internet line. 10 TB over a 100 Mbps connection takes about nine days.

### Is 3-2-1 overkill for a small business?

Small businesses are the ones least able to absorb losing their data. The second copy can be a small appliance and the offsite copy a cloud bucket, and together they cost far less than a week without your files.

## Would your backups survive a bad Monday?

Tell us what you run and where it is kept. We'll map it against 3-2-1 and show you the gaps, with no obligation.

[Ask for a backup review](/contact-us)