A data breach can be very costly. According to IBM’s Cost of a Data Breach Report 2025, the global average cost of a breach is US$4.44 million, and extortion or ransomware incidents average higher, around US$5.08 million. Much of the damage comes from downtime and recovery effort.
What is the 3-2-1 rule?
- 3 copies of data: the original and at least two backups.
- 2 different storage media, for example a storage system and tape or cloud.
- 1 copy kept off-site, separate from the primary location.
Why ransomware makes the rule more important
Ransomware often finds and encrypts backups that are reachable from the main network. Many organizations therefore add immutability or air-gapping: at least one backup copy that cannot be modified or deleted from the running environment.
Common mistakes
- Having backups but never testing a restore.
- Keeping backups on the same network and admin account as production.
- Not defining a recovery time objective (RTO) and acceptable data loss (RPO).
- Backing up servers but ignoring email, network device configs and SaaS data.
Where to start
List critical systems, define RTO and RPO for each, apply 3-2-1 with at least one immutable copy, and schedule regular restore tests. A single assessment session is usually enough to reveal the biggest gaps.