For a decade, 3-2-1 was the whole conversation: three copies of your data, on two different media, with one copy offsite. Then ransomware operators started doing something the original rule never anticipated — deleting or encrypting the backup copies themselves. The 3-2-1-1-0 rule closes that gap by adding a copy attackers genuinely cannot reach and a verification step that turns "we back up" into "we can prove we can restore." For UK IT teams tired of vague reassurances, it gives a concrete, five-part checklist rather than a philosophy. This explainer breaks down what each digit demands, where the two rules diverge, and how to understand the importance of immutable backups before an incident forces the question.
View the data behind this chart
| Layer | Detail |
|---|---|
| 3 Copies | Production data plus two backup copies |
| 2 Media Types | Different storage technologies for resilience |
| 1 Offsite Copy | Kept well away from the primary site |
| 1 Offline / Immutable Copy | Air-gapped copy ransomware cannot alter |
| 0 Verification Errors | Confirmed via automated restore testing |
What Is the 3-2-1-1-0 Backup Rule?
The 3-2-1-1-0 rule is the classic 3-2-1 backup strategy with two extra requirements bolted on. Vendors including Veeam, Cohesity and AvePoint all describe it the same way: keep the original three-copy, two-media, one-offsite structure, then add one offline, air-gapped or immutable copy, and confirm zero errors through recovery verification testing.
It isn't a replacement for 3-2-1 so much as a hardening of it. Datto frames the extra digits explicitly as a defence against ransomware and insider threats — scenarios the original rule, written before modern encryption-and-extort attacks were common, simply didn't have to plan for. Backblaze still calls plain 3-2-1 a simple, effective strategy, but notes vendors now position 3-2-1-1-0 as the version built for current cyberthreats.
The Classic 3-2-1 Rule, In Full
TechTarget's definition is the cleanest: three copies of critical data, on two different storage media types, with one of those copies kept offsite. Veeam Community's implementation guidance reframes the same idea slightly differently — one production copy plus two backup copies, which is the same three-copy total counted from a different starting point.
The 'two media types' requirement exists so a single point of failure — a failed disk array, a corrupted volume, a bad firmware update — can't take out every copy at once. Backblaze's guidance on the offsite copy is that it should sit somewhere genuinely remote, more than a few miles from the other copies, not just in a different room of the same building. This is exactly why RAID alone is not a backup solution — redundancy within one media type or one site solves a different problem to backup.
Why 3-2-1 Stopped Being Enough
Classic 3-2-1 assumes the failure modes are hardware, human error or disaster. It doesn't specifically assume the failure mode is an active adversary with admin credentials. Cohesity's framing is blunt: backup copies can be encrypted or deleted by attackers unless at least one copy is offline or immutable. If your 'offsite' copy is still reachable over the network with the same credentials as production, ransomware that spreads laterally can reach it too.
Datto's positioning is that the rule now has to defend against both external ransomware and insider threats — someone with legitimate access deliberately deleting or corrupting backup data. That's the gap the extra '1' closes, and it's why the rule grew two digits rather than staying at three.
Decoding the Two New Digits
The two '1's in 3-2-1-1-0 mean different things, which is a common source of confusion. TechTarget is explicit: the first '1' is the same offsite copy from the original rule; the second '1' is a separate requirement that at least one copy be kept offline. Veeam and AvePoint both describe this offline copy interchangeably as air-gapped or immutable — physically or logically disconnected from the network, or write-protected so it can't be altered or deleted even by someone with valid credentials. If you want the deeper mechanics of how that protection actually works, it's worth taking time to understand the importance of immutable backups before choosing a platform.
The '0' is the digit most often misread. It does not mean zero backups, and it doesn't mean zero copies of anything — it means zero acceptable errors once you've actually tried to restore. AvePoint frames this as automated verification testing; Cohesity and Datto both describe it as regular testing and validation being part of the target itself, not an optional afterthought bolted on after the backup job succeeds. A backup that has never been restored is a hypothesis, not a control.
Implementing the Rule: Practical Patterns for UK Teams
The five-digit structure scales down as well as up — it describes an architecture, not a specific product stack, so a small business and a large enterprise can both satisfy it with very different tooling.
A small UK business with a single site typically needs: production data, one backup copy on a local device using a different media type to production, and a second backup copy replicated offsite — commonly to a cloud target. The offline/immutable requirement can be met with a cloud backup tier that supports immutability, removing the need for physically rotating removable media. A mid-sized organisation running multiple sites or a hybrid cloud estate usually separates these roles more formally: a backup appliance or software platform handling the local and media-type diversity requirements, a genuinely separate offsite replica, and a distinct immutable or air-gapped copy — sometimes on a delayed replication schedule so a slow-moving attack can't propagate into it before it's noticed. Larger enterprises with regulatory or continuity obligations tend to formalise verification as a scheduled, audited process rather than an ad-hoc check, restoring into an isolated environment on a recurring basis and logging the result as evidence.
Whatever the scale, sizing the backup and offline/immutable tiers correctly matters — undersizing either is one of the most common causes of the rule quietly failing in practice, so it's worth taking the time to accurately size your backup and disaster recovery infrastructure before committing to a platform.
Cost is the most common reason organisations stick with plain 3-2-1 for longer than they should. Classic 3-2-1 already requires two backup copies in addition to the production copy, so the storage overhead of adding a further offline or immutable copy sits on top of a structure most teams have already budgeted for — it isn't starting from zero. The extra cost drivers specific to 3-2-1-1-0 are the offline/immutable tier itself, whether that's an immutability feature on a cloud storage tier, dedicated air-gapped media rotation, or a purpose-built immutable appliance, plus egress charges that can apply when data is retrieved from cloud storage during restore testing or an actual incident. UK teams comparing 3-2-1-1-0 against a simpler 3-2-1 setup should budget explicitly for this extra storage, egress and immutability-feature spend, rather than treating the additional copy as a marginal add-on to existing backup costs.
Choosing Tools Without Locking Into One Vendor
None of the five digits mandate a specific product, and UK buyers are better served comparing categories than chasing a single brand's marketing.
For the two media types, options range from on-premises disk-based backup appliances through to cloud object storage, tape, or a mix — the right combination for you depends on restore-speed requirements as much as cost, which is why it's worth taking time to compare different media types like tape, disk, and cloud for backup before settling on an architecture.
For the offline/immutable copy, the main categories are: cloud storage tiers with built-in write-once/read-many (WORM) or object-lock style immutability, air-gapped or offline removable media rotated out of network reach, and dedicated immutable backup appliances. For the verification layer, look for platforms that support automated recovery testing — spinning up a restore in an isolated sandbox and checking application-level integrity — rather than relying solely on job-success logs, which only confirm the backup ran, not that it's recoverable.
The UK Compliance Angle: GDPR, NCSC and Due Diligence
3-2-1-1-0 is an industry best-practice framework, not a UK statutory requirement — there's no clause in GDPR that names it directly. Its value for UK organisations is as a measurable resilience target that maps well onto expectations that already exist: demonstrating appropriate technical and organisational measures to protect personal data, being able to restore availability and access to data in a reasonable timeframe following an incident, and being able to show evidence of due diligence if a regulator, auditor, cyber-insurer or board asks how ransomware readiness is actually tested rather than assumed.
In procurement terms, this means asking any backup vendor three direct questions: how is offsite separation actually achieved, how is the offline/immutable copy protected from a compromised administrator account, and what evidence of restore verification is produced and retained. Teams building or refreshing an incident response plan should also make sure recovery objectives are explicit rather than assumed — it helps to clarify key disaster recovery metrics like RTO and RPO alongside the 3-2-1-1-0 architecture itself, since a technically compliant backup that takes too long to restore can still fail the business.
Is 3-2-1-1-0 Right for You?
Backblaze's own position is that plain 3-2-1 remains a simple, effective strategy — it isn't obsolete. For organisations with low ransomware exposure, minimal regulatory pressure and straightforward recovery needs, a well-implemented 3-2-1 setup with genuinely separate media and a truly offsite copy can still be adequate.
The trigger for upgrading is less about company size and more about threat exposure and consequence. Any organisation holding data that would be seriously damaging to lose, operating in a sector where downtime has regulatory or safety implications, or simply aware that ransomware groups actively target backup infrastructure, should treat the extra offline/immutable copy and formal verification as non-negotiable rather than aspirational. The practical test is this: if an attacker gained administrator access to your network today, would every one of your backup copies still be reachable and alterable? If the answer is yes to any of them, you don't yet have 3-2-1-1-0 — you have 3-2-1 with an assumption.
Sources
Every figure in this article traces to the sources below.
- •Backblaze — 3-2-1 backup strategy definition and offsite distance guidance
- •Veeam — 3-2-1-1-0 rule explained, adding offline/immutable copy and verification
- •Datto — 3-2-1-1-0 as defence against ransomware and insider threats
- •Cohesity — 3-2-1-1-0 glossary definition and immutable/air-gapped rationale
- •AvePoint — updated framework with automated verification testing
- •TechTarget — how the 3-2-1-1-0 rule reflects modern needs (offline vs offsite)
- •TechTarget — 3-2-1 backup strategy definition
- •Veeam Community — 3-2-1-1-0 golden backup rule digit breakdown
- •Veeam Community — practical implementation guide mapping copies to the rule