The 3-2-1 backup strategy has been the industry standard for so long that the new variant, the 3-2-1-1-0, sounds like a typo. It is not. The extra numbers serve as the answer to the ransomware variant that the 3-2-1 was not designed to handle, the ransomware that targets the backup the same way it targets the production system, the backup that the original 3-2-1 assumed the attacker would not reach. The honest framing matters here, because the backup strategy that the operations team certified last year serves as the backup strategy the ransomware operator read about last year.
What follows runs as the working version of the field guide. The shorter version is what the operations team actually has time to read.
What 3-2-1 was for
Three things, in roughly that order of how much each one mattered when the strategy was first proposed. The first runs as the three copies, where the production data sits in three places, the production, the backup, the offsite, the three copies that protect against the single point of failure. The second runs as the two media, where the backup lives on two different types of media, the disk, the tape, the cloud, the two media that protect against the media failure (the disk crash, the tape degradation, the cloud outage). The third runs as the one offsite, where one of the copies sits offsite, the offsite that protects against the site failure (the fire, the flood, the ransomware that takes the whole site), the offsite that the 3-2-1 always required but the operations team often skipped because the offsite was expensive to maintain.
What 3-2-1-1-0 adds
Two new numbers, in roughly that order of how much each one closes the gap. The first runs as the one immutable, where one of the copies sits immutable, the copy that cannot be modified, the copy that cannot be deleted within the retention window, the immutable that the cloud object lock, the S3 Object Lock, the Azure Blob Immutable Blob Policy all provide. The immutable copy serves as the copy the ransomware cannot touch, the copy that the operations team restores from when the ransomware has encrypted everything else. The second runs as the zero errors, where the backup gets verified, the backup gets tested, the backup gets the recovery drill that proves the data the backup claims to hold can actually be restored, the zero that the original 3-2-1 did not require. The zero errors rule means the operations team treats the backup that has not been restored as the backup that does not exist.
How to land the strategy
Three moves if you are the operations team that has decided the 3-2-1 is not enough for the 2026 ransomware. Add the immutable copy, because the immutable copy sits as the only copy the ransomware cannot encrypt, the cloud object lock costs a few hundred dollars a month, the immutable copy that the operations team turns on serves as the copy that the operations team will need when the breach lands. Run the recovery drill, because the recovery drill that the operations team commits to quarterly serves as the drill that proves the backup works, the drill that finds the broken backup before the breach, the drill that the audit team will ask for. Document the recovery time, because the recovery time that the operations team measures, the time from the breach to the restored service, the recovery time the executive team can read serves as the metric the next budget cycle will fund. The operations team that adds the immutable copy, runs the recovery drill, and documents the recovery time serves as the operations team that has actually landed the 3-2-1-1-0.
The bottom line
The 3-2-1-1-0 in 2026 sits as the backup strategy the 3-2-1 should have been. The three copies, the two media, the one offsite, the one immutable, the zero errors. The operations team that has the five numbers holds the line against the ransomware. The operations team that still has the three numbers does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
