Guides/Backup strategy
3-2-1-1-0: the backup rule built for ransomware.
The classic 3-2-1 rule kept data safe from hardware failure and disaster. Ransomware goes after backups too, so the rule grew two more numbers: one copy an attacker can't change, and zero untested restores.
- 3copies of your data
- Production plus at least two backups, so one failure never leaves you with nothing.
- 2different storage types
- Disk and cloud, or disk and tape, so one media failure or one vendor flaw can't take every copy.
- 1copy offsite
- In a different location, far enough away that one storm, fire or outage can't reach both.
- 1copy immutable or air-gapped
- A copy that can't be changed or deleted, or can't be reached from the network at all.
- 0errors
- Backups verified and restores tested, so you know they work before you need them.
Example layout
Copies kept far apart, inside the U.S.
Two ways to keep a copy safe
Immutable, air-gapped, or both.
Immutable
The copy can't be altered or deleted until its retention period ends, even by an administrator. Ransomware can reach it, but can't encrypt or erase it.
Air-gapped
The copy is isolated from your network, logically or physically, as with tape on a shelf. An attacker who owns your environment still can't reach it.
Why the zero matters
A backup you haven't restored is a guess.
How KELYN covers each part
One managed service, every number in the rule.
| The rule | With KELYN |
|---|---|
| 3 copies, 2 storage types | Datastor keeps Commvault backups in AWS cloud storage alongside your on-premises copy; Spectra Logic tape adds a third medium. |
| 1 copy offsite | Datastor copies live in AWS, inside the U.S., far from your data center. |
| 1 copy immutable or air-gapped | Datastor Assured Recovery (DAR) keeps secure air-gapped and tamper-proof immutable copies behind multi-layered zero-trust access controls. Data on tape sits physically offline, isolated from every network. |
| 0 errors | Recovery Co-Pilot (RECO) tests restores with your team and reports on their quality and speed. Cleanroom Recovery proves recovery in an isolated environment. |
Check yourself
Does your backup follow the rule?
- 01
We keep at least three copies of our critical data.
- 02
Those copies are on at least two different types of storage.
- 03
At least one copy is offsite, far from our primary site.
- 04
At least one copy is immutable or air-gapped, out of an attacker's reach.
- 05
We've tested a full restore in the last quarter, and know how long it takes.
Go further: score your full recovery readiness →
Close the gaps in your backup.
Talk to a KELYN engineer about how many copies you keep, where they live, and when you last proved a restore.