What the 3-2-1-1-0 rule actually says
The 3-2-1-1-0 rule is a data-protection formula for how many copies of your data to keep, on what kind of media, and how to prove they actually work:
- 3 copies of your data: the production copy plus at least two backups.
- 2 different media or storage platforms, so a single technology failure or vendor outage cannot destroy every copy at once.
- 1 copy stored off-site, geographically separated from the primary site.
- 1 additional copy that is immutable or air-gapped, so it cannot be changed or reached even by an attacker with administrative credentials.
- 0 errors: every backup verified and restores tested, not just assumed to work.
The first three digits are the classic 3-2-1 rule. The second "1" and the "0" came later. Veeam says it "extended the rule to 3-2-1-1-0", and gives the reason for the extra copy directly: "ransomware increasingly targets backups." Understanding why the two digits were added explains more about modern backup strategy than the checklist alone.
Where the rule came from
The "3-2-1" part of the name predates ransomware as a mainstream threat. It is credited to photographer Peter Krogh and his book The DAM Book: Digital Asset Management for Photographers. Krogh did not invent the idea of redundant, off-site copies; he gave it a name simple enough to remember.
A 2012 paper written for US-CERT, Data Backup Options, is the usual reference point. It states the rule as "Keep 3 copies of any important file: 1 primary and 2 backups", "Keep the files on 2 different media types to protect against different types of hazards" and "Store 1 copy offsite", and cites the 2009 second edition of Krogh's book as its source.
The same basics are still in current guidance. NIST's Cybersecurity Framework 2.0 lists the outcome "Backups of data are created, protected, maintained, and tested" (PR.DS-11). CISA's #StopRansomware Guide tells organizations to "maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario."
The original 3-2-1 rule was designed for the threats of its era: disk failure, fire, flood, theft, and accidental deletion. Its core assumption was that no single physical event could plausibly destroy three copies of data spread across two media types and two locations.
Why 3-2-1 alone stopped being enough
The assumption broke when ransomware operators started treating backup infrastructure as a primary target rather than an obstacle to route around. Three copies on two media types with one off-site still fully satisfy 3-2-1 even if all three are reachable with the same set of compromised credentials. That is exactly the scenario modern ransomware groups look for. CISA's guide says so plainly: "most ransomware actors attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid."
The survey data points the same way. Veeam's 2025 Ransomware Trends report, based on a survey of 1,300 organizations, 900 of which had been hit by ransomware in the previous 12 months, found that 89% of the attacked organizations had their backup repositories targeted by the threat actor, and that on average 34% of their backup repositories were modified or deleted. Sophos's State of Ransomware 2025, a survey of 3,400 IT and cybersecurity leaders whose organizations were hit by ransomware, found that only 54% of organizations whose data was encrypted restored it using backups, which Sophos calls the lowest rate in six years. Of the 151 organizations in that survey that paid more than the attacker's initial demand, 38% said their backups had failed or were malfunctioning.
Three geographically separate copies do nothing to stop an attacker who already has the credentials to delete all three. That gap is what the two extra digits were designed to close.
The extra "1": one copy attackers genuinely cannot reach
The additional "1" requires at least one copy that is either immutable or air-gapped. Immutable means protected from modification or deletion for a defined retention period, typically through Object Lock on cloud object storage, Write Once Read Many (WORM) hardware, or a hardened repository that enforces retention at the storage layer. Air-gapped means there is no standing network path from production to the copy at all.
This is a stricter requirement than it first appears. Two cloud regions from the same provider, both reachable with the same administrative account, do not satisfy it: geographic separation without credential separation does not protect you from an attacker who already has domain admin. CISA makes a related point about cloud backups, suggesting a multi-cloud approach "in case all accounts under the same vendor are impacted." Stronger implementations often combine immutable cloud storage for fast recovery with an offline or air-gapped copy for the worst case, where even the immutable tier's management plane has been compromised.
Immutability has trade-offs of its own. CISA's guide notes that some cloud vendors offer immutable storage that protects data without a separate environment, and adds a warning: "Use immutable storage with caution as it does not meet compliance criteria for certain regulations and misconfiguration can impose significant cost."
The "0": proving the backup actually works
The "0" is the operational half of the rule, and the easiest one to skip. It demands zero unverified backups: every backup checked for integrity and every restore path periodically tested end to end, not just monitored for a green "job succeeded" notification. Veeam describes the digit as "zero recovery errors"; CISA's version is to "regularly test the availability and integrity of backups."
A successful backup job and a clean restore are different things. Veeam's 2024 Ransomware Trends report found that only 37% of the attacked organizations it surveyed used a sandbox of some kind during recovery. Without a staging area where recovered data is scanned before it goes back into production, a restore can bring the attacker's malware back with it and turn a recovery into a second incident.
The "0" exists because a backup that has never been restored is not a control. It is an assumption. Verification, done on a schedule and measured against realistic recovery-time targets, is what turns that assumption into a fact you can rely on during an actual incident. For how to set that target and check it against a real restore time, see our RTO vs RPO guide.
Common mistakes when implementing 3-2-1-1-0
- Counting two cloud regions as "two media." Media-type diversity means genuinely different storage technologies or platforms, not two instances of the same object store.
- Treating the extra "1" as satisfied by any off-site copy. Off-site addresses geography; immutable or air-gapped addresses credential compromise. A rule-compliant off-site copy that shares an identity plane with production does not close the gap that motivated adding the digit.
- Skipping the "0" because backup jobs report green. A successful backup job confirms data was written. It does not confirm the data is restorable, application-consistent, or free of the malware that will necessitate the restore.
- Applying the rule uniformly regardless of data criticality. Tier-one systems generally warrant more frequent verification and shorter RTOs than archival data; a single retention and testing policy across an entire estate usually under-protects the systems that matter most and over-spends on the ones that don't.
Is 3-2-1-1-0 still enough in 2026?
For most organizations, implementing 3-2-1-1-0 correctly closes a significant part of the gap that lets ransomware turn backup infrastructure into a target. Correctly means the immutable or isolated copy and the recovery verification are genuinely enforced, not just checked off.
It remains a sound operational baseline. Veeam explicitly advocates the 3-2-1-1-0 model. NIST and CISA reinforce the underlying controls: protected backups, offline copies, and regular testing. CISA also mentions immutable storage as an option, with the caveats quoted above.
Where the rule falls short is not redundancy, but the surrounding security architecture. It tells us how many copies to maintain, where they should exist, and what state they should be in. It does not fully define the access governance, administrative trust boundaries, network segmentation, monitoring, and recovery architecture required to keep those copies protected during an active compromise. Those controls are what backup security covers.
That is the gap BackupSec's Fibonacci Rule of Backup Security (5-3-2-1-1-0) is designed to address. It does not replace 3-2-1-1-0; it extends it with five foundational security principles.
For organizations still working toward a fully implemented and regularly verified 3-2-1-1-0 strategy, that foundation comes first. The Fibonacci Rule is the architectural layer that builds on top of it.
Where BackupSec comes in
BackupSec works on the Veeam side of this problem. Four of our services map onto the rule:
- ZeroMON monitors Veeam Backup & Replication. It runs on-premises as an OVA, connects with a read-only account, and sends nothing to BackupSec or any third party. It tracks job health, records configuration changes (who changed what, and when), runs a security checklist, and shows the immutability status Veeam reports from its own repository settings. Alerts arrive by email and in-app notification. ZeroMON reads Veeam's configuration; it does not verify locks on the storage itself and does not run restore tests. It tells you when the conditions behind your "1" and "0" change; restore testing is a separate job.
- ZeroVault is S3-compatible cloud object storage with Object Lock, used as an off-site immutable target for Veeam backups. Unlike ZeroMON, it holds backup data outside your environment by design, because that is what an off-site copy is.
- ZeroTAM gives you a dedicated backup-security advisor for architecture, capacity, ransomware recovery planning, and priority crisis support. It is advisory work, not software: the person you ask whether your extra "1" is actually isolated or only far away.
- ZeroPEN is a threat-led penetration test of Veeam Backup & Replication, Veeam ONE, and Enterprise Manager. It simulates a ransomware kill chain in eight stages mapped to MITRE ATT&CK, from initial access through repository access and backup neutralization to proof of encryption capability. It is non-destructive: ZeroPEN "never deletes real backups, performs real encryption, or stops production or backup services." The engagement also includes restore-integrity and immutability verification, ends with an audit-ready report package, and includes a retest of critical findings.
Talk to BackupSec about your backup security posture →
Want a quick self-check first? The free Backup Security Assessment asks 28 questions across seven areas, from backup strategy and access control to recovery testing.