Three copies of your data.

You should always have three distinct copy of your backup.

One copy is the production data (i.e., the original data that you use for real-world) purposes. The other two copies are backups.

Each copy of the data -- the production copy and the two backups -- should be stored and configured in such a way that it will remain intact even if the other copies fail or disappear.

Finally, each of these copies should contain the same version of the data. In other words, you don’t satisfy this rule if you have one copy of data from a backup that you performed yesterday, and two other copies that were created last week. All copies need to contain the same data from the same point in time. (Creating data backups from multiple points in time is often a good idea, but it’s not part of the 3-2-1 backup rule.)

Two storage media for your data

Second, at least two of the copies of your data should exist on storage devices that are physically independent from each other. For example, one could be on a hard drive inside a server, and another could be a flash drive that is not attached to the server.

Storing different copies of data on different internal hard drives within the same server is not enough, because the failure of that server would make all the copies inaccessible. For the same reason, you can’t meet this part of the 3-2-1 backup rule by storing multiple copies of your backups on the same RAID array, or in the same cloud. The storage media should be independent of each other.

One data copy should exist offsite

The third and final part of the 3-2-1 backup rule is that at least one copy of your data should exist in an offsite location, meaning one that is physically located in a different place than other copies.

Thus, if two of the copies of your data are stored in your office (one on a production server, and the other on an external hard disk, for example), you should store the copy at a different site -- such as another office, or in a cloud-based data center.