The 3-2-1 backup rule — three copies, two media, one offsite — was once the ceiling for good practice. In 2026 it's the floor. Ransomware operators now target connected backup infrastructure directly, which is why the security community has moved to 3-2-1-1-0: one immutable or air-gapped copy, plus zero errors proven through verified restore testing. For UK IT leaders this isn't optional polish — it maps directly onto NCSC guidance and GDPR Article 32's demand for "appropriate technical measures." This piece sets out what 3-2-1-1-0 actually costs in GBP, how to implement it against UK compliance expectations, and what "zero errors" means in practice rather than in theory.
View the data behind this chart
| Layer | Detail |
|---|---|
| 3 copies | Production data plus two backup copies |
| 2 media types | e.g. disk and cloud object storage, or WORM tape |
| 1 offsite copy | Stored in a separate physical location |
| 1 immutable/air-gapped copy | Object lock or offline media, unreachable by… |
| 0 errors | Proven via automated, scheduled restore testing |
The threat landscape that broke 3-2-1
3-2-1 was designed for a world of disk failures, fires and accidental deletions — not for adversaries who deliberately hunt down and encrypt backup repositories before triggering the main ransomware payload. Once an attacker has domain admin, a backup copy sitting on the same network, reachable with the same credentials, is not a third copy of your data. It's a fourth copy of the problem.
NIST IR 8374 makes the underlying assumption explicit: incident response plans must exist offline, because a serious incident may eliminate access to digital copies of those plans altogether. That single line captures why 3-2-1 alone no longer counts as resilience — if every copy of your data (and your recovery documentation) is reachable from a compromised network, you don't have three copies, you have one copy with three names.
3-2-1 recap: still necessary, never sufficient
The original rule is straightforward and remains a correct starting point: keep at least three copies of your data, on two different types of media, with one copy stored offsite. Read the 3-2-1 backup rule explained if you need the fundamentals refreshed — the mechanics haven't changed, and neither has the logic.
What's changed is what counts as "good enough." A cloud replica that's constantly writable from the production network satisfies the letter of 3-2-1 while failing the spirit of it entirely. If ransomware can reach and overwrite that offsite copy with the same ease as the primary, the rule has been followed and resilience has still failed.
3-2-1-1-0: the two lines that actually matter now
3-2-1-1-0 keeps the original three requirements and bolts on two more: one copy that is immutable or air-gapped, and zero errors in backup verification. Some vendors describe an intermediate step, 3-2-1-1, which simply adds the immutable copy without the verification discipline — useful as a stepping stone, but incomplete on its own.
Immutability means the backup repository has object lock or equivalent immutable storage enabled, so that data cannot be altered or deleted — not by an attacker, not by an admin, not even by accident — until a retention clock expires. Retention should run a minimum of 30 days, with 60-90 days recommended for cloud backups specifically. For a deeper comparison of the two routes to that same outcome, see what is immutable backup.
Air-gapping is the alternative (or complementary) route: either a genuine physical gap — quarterly snapshots on media kept completely offline for critical systems — or logical isolation with strict access controls. In practice, logical isolation means hardening the backup repository itself: single-use credentials, disabled root access, and removal of unnecessary protocols, with restore permissions kept deliberately tighter than backup permissions so that writing a backup and overwriting or deleting one are never the same privilege. NIST backup guidance treats both physical and logical isolation as valid implementations, and for the most critical systems, doing both isn't overkill.
UK compliance: NCSC, GDPR and what auditors actually expect
For UK organisations this isn't a nice-to-have architecture debate. NCSC's Cyber Assessment Framework expects demonstrable data resilience, and GDPR Article 32 requires "appropriate technical measures" to protect personal data — an immutable, verified backup copy is one of the cleanest ways to evidence that requirement in an audit. NCSC's own ransomware defence guidance specifically recommends immutable or air-gapped backups, which is why 3-2-1-1-0 is fast becoming the de facto compliance baseline rather than a best-practice aspiration.
The practicalities matter as much as the principle. Hardened backup repositories should run on single-use credentials, with root access disabled and unnecessary protocols removed. Restore permissions should be tighter than backup permissions — the ability to write a backup is not the same privilege as the ability to overwrite or delete one. For the operational trade-offs between physical isolation and logical isolation, immutable vs air-gapped backup covers the decision in more depth than a single paragraph can.
What it actually costs: SMB and mid-market tiers
UK MSPs increasingly bundle 3-2-1-1-0 compliance as a standard tier rather than an add-on, typically priced at £15-£35 per user, per month for enterprise-grade backup that includes immutability and automated verification — though this baseline quota excludes storage consumed beyond it. Where you sit in that range depends on user count, retention depth and how much automated restore testing is included by default.
Storage itself carries its own premium. Immutable, object-lock-enabled storage tiers on the major clouds run roughly £0.02-£0.05 per GB per month, against £0.015-£0.03 per GB per month for standard (non-immutable) tiers. That gap is the price of ransomware-proofing a copy — modest per gigabyte, but it compounds at scale, which is exactly why retention windows (30 days minimum, 60-90 recommended) need to be sized deliberately rather than left at vendor defaults.
View the data behind this chart
| Standard tier | Immutable tier | |
|---|---|---|
| Low (£/GB/month) | £/GB/mon…0.015 | £/GB/mon…0.02 |
| High (£/GB/month) | £/GB/mon…0.03 | £/GB/mon…0.05 |
Worked examples: small office and cloud-native SaaS
A small UK office running mostly on-premise file shares and a handful of servers can build 3-2-1-1-0 with a local disk backup, a cloud copy on an immutable object-lock tier, and quarterly offline snapshots of the most critical systems retained completely disconnected from the network. Monthly automated test restores of a handful of files from each backup set close the loop.
A cloud-native business running its operations through SaaS platforms faces a different trap: assuming the SaaS vendor is already doing this for them. Microsoft 365 workloads must be explicitly brought into scope for 3-2-1-1-0 — the platform's native retention is not a substitute for an independent, immutable, verified backup under the shared responsibility model. Comparing options properly, rather than defaulting to whatever the reseller bundles in, is worth the time; see our Microsoft 365 backup comparison for how the third-party options differ.
The '0': proving recoverability, not assuming it
Zero errors is the requirement competitors mention and then wave away. It means a defined, repeated testing cadence, not a one-off proof-of-concept restore from the day the system went live. The minimum viable version is monthly automated test restores of 5-10 critical files from each backup set — small, fast, and cheap enough that there's no excuse to skip it.
Above that sits a quarterly full system restore drill for most critical systems, with the time required documented every time — because RTO you haven't measured recently is RTO you're guessing at. Once a year, a full disaster recovery exercise should simulate complete infrastructure loss and confirm the business can actually keep operating, not just that files can be pulled back. CISA guidance adds a useful yardstick here: restore capability should be verified to cover at least seven days of operations, and behavioural monitoring on the backup infrastructure itself should be catching anomalies in real time, ideally stopping ransomware at the point of execution rather than after the fact.
Which path fits your business — and the verdict
If your organisation still treats 3-2-1 as the finish line, the honest answer is that you're compliant with a 2010s threat model. The verdict for 2026 is simple: 3-2-1-1-0 is not a premium tier reserved for enterprises with dedicated security teams — it's what NCSC-aligned, GDPR-defensible resilience looks like at any size, with MSP-bundled pricing (£15-£35 per user/month) putting it within reach of most UK SMBs.
Start with the immutable copy and the retention window, because that single change closes the gap ransomware exploits most often. Then build the testing cadence — monthly, quarterly, annual — because an unverified backup is a belief, not a control. Everything else is refinement.
Sources
Every figure in this article traces to the sources below.
- •Castle Rock Sky — 3-2-1-1-0 framework, retention windows, testing cadence
- •SentinelOne — NIST/CISA backup guidance, hardened repositories, restore permissions
- •AvePoint — SaaS workloads in scope for 3-2-1
- •FloSum — 3-2-1-1 as an intermediate step