--- title: "The 3-2-1-1-0 Backup Rule Explained" description: "The modern 3-2-1-1-0 backup rule for ransomware resilience: three copies, two media, one offsite, one offline, zero recovery errors. Where Firevault fits." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/3-2-1-1-0-backup-rule#webpage", "url": "https://fire-vault.com/learn/3-2-1-1-0-backup-rule", "name": "The 3-2-1-1-0 Backup Rule Explained", "description": "The modern 3-2-1-1-0 backup rule for ransomware resilience: three copies, two media, one offsite, one offline, zero recovery errors. Where Firevault fits.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-learn.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/3-2-1-1-0-backup-rule#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/3-2-1-1-0-backup-rule#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "The 3-2-1-1-0 Backup Rule Explained", "item": "https://fire-vault.com/learn/3-2-1-1-0-backup-rule" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the 3-2-1-1-0 backup rule?", "acceptedAnswer": { "@type": "Answer", "text": "It is the modern extension of the 3-2-1 rule for the ransomware era. Keep three copies of your data, on two different media, with one copy offsite, plus one copy offline and zero errors on recovery. The two extra numbers exist because attackers now specifically target reachable backup infrastructure." } }, { "@type": "Question", "name": "How is 3-2-1-1-0 different from the classic 3-2-1 rule?", "acceptedAnswer": { "@type": "Answer", "text": "The classic 3-2-1 rule assumes the threat model is failure and disaster. The 3-2-1-1-0 rule adds one offline copy and zero recovery errors to reflect that the current threat model is a determined attacker who targets backups first and encrypts the reachable copies. The offline copy is the one they cannot reach." } }, { "@type": "Question", "name": "Does immutable cloud storage satisfy the offline 1 in 3-2-1-1-0?", "acceptedAnswer": { "@type": "Answer", "text": "No. Immutable cloud storage is still online. It is a logical control on a network that remains reachable and defended by identity. The offline 1 in the rule specifically calls for a copy that has no network path, which is what a physical air gap like Firevault Offline Secure Storage provides." } }, { "@type": "Question", "name": "How does Firevault satisfy the offline 1 in the rule?", "acceptedAnswer": { "@type": "Answer", "text": "Firevault Offline Secure Storage is a physical air gap at Layer 1. The storage hardware has no network interface enabled while offline, so there is no IP, no listener and no credential path. Connection windows are scheduled, identity verified and logged on a separate management plane, giving you the offline 1 with a tamper evident audit trail." } }, { "@type": "Question", "name": "How do I prove the zero on recovery to auditors and insurers?", "acceptedAnswer": { "@type": "Answer", "text": "Run scheduled test restores, log the outcome and keep the evidence. Firevault connection logs record every online window and its purpose, which combines with your backup platform's restore test log to prove end to end that the gold copy is verifiably restorable. That is what most cyber insurance renewals are now asking for." } } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Why OSS # The 3-2-1-1-0 Backup Rule Three copies, two media, one offsite, one offline, zero recovery errors. The modern reading of the backup rule, and where a physical air gap sits inside it. Book a demo ![Corridor of offline storage racks inside a Firevault bunker](/assets/hero-square-bunker-BC9Flanh.jpg) R4 The five numbers ## What Each Number Actually Requires Plain definitions for each digit in the rule, and what a modern ransomware resistant estate needs to satisfy them. 01 Production plus two backups ### 3 copies of your data Keep at least three copies of every important dataset. The live production copy counts as one. Two independent backup copies protect against the failure of any single storage system, and against the ransomware playbook that targets a single backup platform first. - Production is copy one - Two independent backups - No single storage dependency 02 Diverse failure and attack modes ### 2 different media Spread the copies across at least two different storage media. Disk and object storage. Object and tape. Cloud and physically disconnected disk. Different media fail differently and are targeted differently, so a single class of failure or exploit cannot take every copy at once. - Diverse storage types - Diverse vendors and firmware - Diverse attack surfaces 03 Protection against site loss ### 1 copy offsite At least one copy lives away from the primary site, whether that is another data centre, another region or a Firevault Bunker. Fire, flood and localised destructive attacks stop at the site boundary, and the offsite copy remains available to rebuild from. - Different site or region - Independent power and network - Survives physical disaster 04 The physical air gap Firevault provides ### 1 copy offline One copy is offline and out of reach of the production network. This is the modern addition to the classic 3-2-1 rule and the one that ransomware operators cannot defeat remotely. Firevault Offline Secure Storage is designed specifically to be this copy, with Layer 1 disconnection and a tamper evident audit trail. - No network path when offline - Out of band switching only - Tamper evident connection log 05 Verified restores, not hopeful ones ### 0 errors on recovery A backup that has never been restored is not a backup, it is a belief. The zero on the end of the rule requires regular, verified test restores that prove the copies are readable and consistent. A gold copy that cannot be restored on demand is worse than no plan at all. - Scheduled test restores - Integrity verified end to end - Runbooks proven, not written Read the pillar guide, or continue with the comparison against immutable backup. [Physical air gap storage for ransomware protection](/learn/physical-air-gap-ransomware-protection) [Air gap vs immutable backup](/learn/air-gap-vs-immutable-backup) [What is Offline Secure Storage](/offline-secure-storage) Questions ## The 3-2-1-1-0 Backup Rule, Common Questions Straight answers on how Offline Secure Storage® behaves in practice. ### What is the 3-2-1-1-0 backup rule? ### How is 3-2-1-1-0 different from the classic 3-2-1 rule? ### Does immutable cloud storage satisfy the offline 1 in 3-2-1-1-0? ### How does Firevault satisfy the offline 1 in the rule? ### How do I prove the zero on recovery to auditors and insurers? ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) ![David Bailey](/assets/david-bailey-CnLw95Ao.jpg) ![Kenny Phipps](/assets/kenny-phipps-DxIqwaIL.jpg) Online Now Concierge ## Add the offline 1 to your backup strategy Talk to the Firevault team about adding a Layer 1 offline gold copy so your estate satisfies the modern 3-2-1-1-0 rule. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up