3-2-1 backup strategy in practice: no fluff, just what actually works
What 3-2-1 means in a real-world environment, where common mistakes happen, and why the restore test is more important than the strategy itself.
Backups are often discussed but rarely tested. The 3-2-1 strategy is a sound starting point: three copies of data, on two different media, one offsite. However, a strategy without a tested restore is just a belief that the backup works.
What 3-2-1 means in practice
- 3 copies: production + two backups
- 2 different media: e.g., local disk and cloud
- 1 copy offsite or out of administrator reach (offline / immutable)
Common mistakes
- The backup runs, but the restore is never tested
- The cloud backup is accessible with the same administrator account (ransomware deletes it)
- Microsoft 365 data is not included (M365 is not a backup)
- The backup covers servers, but not application databases
- Retention is too long (costs) or too short (insufficient security)
Microsoft 365 is not a backup
Microsoft guarantees that data will not be lost due to their error. They do not guarantee that a user will not delete a folder or that an attacker will not encrypt OneDrive. For email, OneDrive, SharePoint, and Teams, it makes sense to have a separate backup solution.
Restore test
At least once every few months, restore a random file, a mailbox, and (by agreement) an entire server into a test environment. Record how long it took. This is the only real indicator that the backup works.