Free tool · Ransomware · Backup

3-2-1-1-0 Backup Rule Checker

The 3-2-1-1-0 rule says keep 3 copies of your data on 2 media types, 1 off-site, 1 offline or immutable, with 0 errors in a verified restore. The offline or immutable copy is the one that survives an attacker who has your admin accounts. Enter each system and its backup copies to see which parts it fails, how old your ransomware-safe copy is against the RPO, and what to fix first.

No download, no card

Add a system

Restore test counts if within

This is a fictional example estate. Edit it, or start blank and add your own systems. One card per system or data set. The live production data counts as copy one; list every backup copy under it. Snapshots on the production storage and a SaaS provider’s recycle bin or retention are shown but not counted as copies. Nothing leaves your browser.

Ransomware-resilience score

54/100 · Exposed

1 of 4 meet all five parts of the rule. 2 have no offline or immutable copy.

Pass or fail for each part of the 3-2-1-1-0 rule, per system
System	3 3 copies	2 2 media types	1 1 off-site	1 1 offline or immutable	0 0 restore errors	Score
File server	✓	✓	✓	✓	✓	100
Microsoft 365 (mail, OneDrive, SharePoint)	✗	✗	✗	✗	✗	0
Finance database	✓	✓	✓	✗	✗	45
Virtual machines (hypervisor cluster)	✓	✓	✓	✓	✗	70

Per system: 3 copies 15, 2 media 10, off-site 15, offline or immutable 25, clean restore test 20, plus 5 each for separate credentials with MFA, encryption, and a ransomware-safe copy fresh enough for the RPO.

Fix first

The missing offline or immutable copy on each system, then everything else. Full list in the report.

1
Microsoft 365 (mail, OneDrive, SharePoint)
Add one immutable copy (object lock in compliance mode, WORM media or a hardened repository) or one offline copy (ejected tape, disconnected and rotated disk). This is the copy that survives ransomware.
2
Finance database
Switch the retention lock to a mode no administrator can lift (for example S3 Object Lock in compliance mode or a hardened repository), or add an offline copy. An attacker holding your admin accounts has the same rights you do.
3
Microsoft 365 (mail, OneDrive, SharePoint)
[3 copies] Add 2 more independent backup copies. Snapshots on the production storage and provider recycle bins or retention do not count: they fail with the production platform or account. For a SaaS service, that means a backup held outside the provider tenant, such as a third-party backup service or an export to your own object storage.
4
Microsoft 365 (mail, OneDrive, SharePoint)
[2 media types] Put one copy on a different media type, such as cloud object storage or tape, so a single failure (a storage bug, a platform outage, a wiped array) cannot reach every copy.
5
Microsoft 365 (mail, OneDrive, SharePoint)
[1 off-site] Keep one copy outside the provider tenant, in a separate account or with a different provider, so losing the tenant or its admin account does not lose the backups.
6
Microsoft 365 (mail, OneDrive, SharePoint)
[0 restore errors] Restore this system to a working state, check the application and data, and record the date, time taken and any errors.
7
Microsoft 365 (mail, OneDrive, SharePoint)
[RTO] Time the next restore test end to end, until users can work, and compare it with the RTO.
8
Finance database
[0 restore errors] Fix the cause of the errors (missing data, corrupt files, application did not start) and retest until the restore is clean.
+ 5 more in the copied report.

TL;DR

What this tool is

The 3-2-1-1-0 rule: 3 copies of your data, on 2 different media types, 1 copy off-site, 1 copy offline or immutable, and 0 errors when you restore-test it.
List each system (file server, Microsoft 365, databases, virtual machines, SaaS apps) and every backup copy: media, location, whether an admin can delete it, encryption, separate admin login with MFA, and how often it refreshes.
Get a pass or fail for each part of the rule on every system, a 0–100 ransomware-resilience score, and the specific fix for each gap.
The RPO check asks the question most backup reviews skip: how old is your newest offline or immutable copy, and how much data would you lose restoring from it?
Copy the result as a plain-text report. Runs in your browser; nothing is uploaded.

The 3-2-1-1-0 rule, part by part

Each part, what this checker counts, and what it does not.

Part	Counts	Does not count
3 Three copies of the data	The live production data plus two independent backups.	Snapshots on the production storage; a SaaS recycle bin, retention policy or version history.
2 Two different media types	Disk plus object storage, tape, removable disk or a separate cloud backup service.	Production disk plus a backup appliance that is also disk (under the strict reading this checker uses).
1 One copy off-site	Another site, data centre or region, or a separate cloud account or provider.	A second rack in the same building; for SaaS, anything inside the same tenant.
1 One copy offline or immutable	Compliance-mode object lock, WORM media, a hardened repository, an ejected tape, a disconnected disk.	A lock an admin can lift (governance mode, soft delete); a replica, which copies the encryption too.
0 Zero errors in a verified restore	A clean restore to a working system, application checked, dated, inside your test window.	A green backup job; a restore that “mostly worked”; a test nobody wrote down.

Where the rule comes from

The original 3-2-1 rule is widely credited to the photographer Peter Krogh, who set it out in The DAM Book, his guide to managing digital photo archives: three copies, two kinds of media, one somewhere else. It was written for disk failure, theft and fire.

Ransomware changed the threat. An attacker who becomes a domain or backup administrator can delete or encrypt every copy they can reach, so three online copies can be lost together. Backup vendors added the last two digits; Veeam’s best-practice guide, for example, defines 3-2-1-1-0 as one copy offline, air-gapped or immutable and zero errors through regular recovery verification. It is a widely used industry extension, not a formal standard.

Government guidance points the same way. The joint #StopRansomware Guide from CISA, the FBI, the NSA and MS-ISAC (updated September 2023) says to maintain offline, encrypted backups of critical data and to regularly test their availability and integrity in a disaster recovery scenario, because many ransomware variants look for and delete or encrypt accessible backups.

Backup copy types the checker knows

Backup disk, NAS or backup appliance — counts as a copy.
Cloud object storage — counts as a copy.
Tape — counts as a copy.
Removable disk, rotated — counts as a copy.
Third-party cloud backup service — counts as a copy.
Replica or standby system — counts as a copy. Replication copies encryption and deletion within minutes. Keep point-in-time restore points, or it is not a backup.
Snapshot on the production storage — shown, not counted. Not counted: it fails with the production array or account, even when the snapshot is immutable.
Provider recycle bin, retention or versioning — shown, not counted. Not counted: it lives in the same tenant and account as the live data.

Protection levels

Online: an admin can delete or overwrite it — does not pass.
Immutable, but an admin can lift it (governance mode, soft delete) — does not pass.
Immutable: object lock compliance mode, WORM, hardened repository — passes “1 offline or immutable”.
Offline or air-gapped: ejected tape, disconnected disk — passes “1 offline or immutable”.

The RPO question most reviews miss

Your recovery point objective (RPO) is how much data you can afford to lose. If ransomware encrypts every online copy, you restore from the offline or immutable one, so what matters is how old that copy is. A database with a one-hour RPO and a weekly tape is a week of lost transactions in a ransomware case, even if its hourly disk backups look perfect. The checker compares the refresh interval of the newest offline or immutable copy with the RPO for every system, and flags when a restore took longer than the RTO.

For restore-testing schedules, RPO and RTO per tier and the policy text, use the Backup and Restore-Test Policy Builder. To see where backups sit in your wider ransomware defences, take the Ransomware Readiness Scorecard.

Frequently asked questions

What is the 3-2-1-1-0 backup rule?

Keep 3 copies of your data (the live data counts as one), on 2 different media types, with 1 copy off-site, 1 copy offline or immutable, and 0 errors when you verify a restore. The first three numbers are the classic 3-2-1 rule. The last two were added for ransomware: attackers who take over admin accounts go after the backups, so one copy must be out of their reach, and a backup only counts once a restore from it has been tested.

Who created the 3-2-1 backup rule?

The 3-2-1 rule is widely credited to the photographer Peter Krogh, who described it in The DAM Book, his guide to digital asset management for photographers. The 3-2-1-1-0 version is an industry extension promoted by backup vendors, Veeam among them; it is common practice, not a formal standard.

Is the 3-2-1 backup rule enough to survive ransomware?

Not on its own. Three copies on two media with one off-site can all be online and deletable by the same administrator account. Ransomware operators who reach that account can delete or encrypt every copy. That is why the extension adds one offline or immutable copy and verified restores. CISA’s #StopRansomware Guide gives the same advice: keep offline, encrypted backups of critical data and regularly test their availability and integrity.

Do snapshots or the Microsoft 365 recycle bin count as a backup copy?

This checker does not count them. A snapshot on the production storage fails with that storage, and a SaaS recycle bin, retention policy or version history lives in the same tenant, under the same admin accounts, as the live data. They are useful for quick undo, but for the 3-2-1-1-0 rule you need copies that survive losing the production platform or its admin account.

What counts as an immutable or air-gapped backup?

Immutable means no one, including an administrator, can change or delete the copy until its retention period ends: for example object storage with a compliance-mode lock, WORM media or a hardened backup repository. A lock that an administrator can lift, such as a governance-mode lock or a soft-delete setting, does not protect you from an attacker holding that administrator account. Air-gapped or offline means the copy is not reachable over the network, such as an ejected tape or a disconnected, rotated disk.

What does the 0 in 3-2-1-1-0 mean?

Zero errors in a verified restore. You restore the data to a working system, check that the application starts and the data is complete, and record the result. A backup job that reports success is not the same thing. This checker counts a test only if it was clean and within the window you choose (3, 6 or 12 months).