3-2-1 Backup: Copies, Locations, and Offsite Storage Explained Simply

The 3-2-1 backup rule tells you exactly how many copies of your data to keep, what types of storage to use, and where to store them. This guide breaks down each component in plain terms so any IT professional can implement it immediately.

The 3: Three Copies of Your Data

Three copies means your production data plus two backup copies. Why three? Because hardware fails. If your only backup copy sits on the same storage system as production and that system fails catastrophically, you have nothing. Two copies means losing one still leaves you recoverable. Three copies ensures that even if two fail simultaneously, you remain protected.

The three copies do not need to be identical in format or retention. Your local backup copy might hold 30 days of restore points. Your offsite copy might hold 90 days with longer-interval snapshots. Both serve different recovery scenarios.

The 2: Two Different Media Types

Two different media types means your copies are not all on the same class of storage. If copies 1 and 2 are both on local disk arrays from the same manufacturer, a firmware bug or controller failure could take both out simultaneously. Spreading across media types — disk plus cloud, or disk plus tape — eliminates single-class failure risk.

The 1: One Copy Offsite

One copy must be in a physically separate location. Fire, flooding, power failure, and physical theft are site-level risks that no amount of on-site redundancy can protect against. The offsite copy is your protection against the site itself becoming unavailable.

In 2026, cloud object storage with object lock enabled is the standard offsite tier. It is cost-effective, geographically distributed, and immutable when configured correctly — ransomware cannot delete or encrypt it even if it has network access to your environment. For organizations implementing this architecture, a 3 2 1 backup setup using a StoneFly appliance for the local tier and cloud object storage for the offsite tier is a proven, well-supported configuration.

Putting It Together

Copy 1: Local backup appliance with 30-day retention. Copy 2: Secondary storage or replicated appliance at a secondary site. Copy 3: Cloud object storage with immutability enabled and 90-day retention. Verify all three copies weekly. Test restores monthly.