The 3-2-1 rule means keeping three copies of your data, stored on two different types of media, with one copy offsite. For example: production data on your servers, a local backup copy on a backup appliance or NAS, and a replicated copy in the cloud. This strategy ensures that no single failure, including a fire, hardware failure, or ransomware attack, can destroy all copies of your data simultaneously. Many cyber insurance policies and compliance frameworks reference the 3-2-1 rule as a baseline expectation.

Backup refers to creating recoverable copies of data. Disaster recovery (DR) is the broader process of restoring business operations after a disruptive event, which includes recovering data from backup but also covers infrastructure recovery, failover, and the procedures your team follows to get systems back online. A backup appliance is a tool. A disaster recovery plan defines the recovery time objective (RTO) and recovery point objective (RPO) that tell you how fast you need to recover and how much data loss is acceptable.

Microsoft 365 replicates data across its own infrastructure for availability, but this is not the same as backup. Microsoft's service-level agreements cover infrastructure uptime, not data recovery from accidental deletion, ransomware encryption, or malicious insider activity. Deleted items are recoverable for a limited window after deletion, and that window can be shortened or eliminated by ransomware that deliberately purges the recycle bin. A dedicated Microsoft 365 backup solution retains independent copies of Exchange, SharePoint, OneDrive, and Teams data with longer retention and granular recovery options.

Immutable backup storage uses a write-once policy that prevents any user, application, or process from modifying or deleting a recovery point during its defined retention period. Even an administrator with full credentials cannot alter or delete an immutable backup until the retention period expires. This protects recovery points from ransomware that specifically targets backup systems and from accidental or malicious deletion by internal users. Both on-prem and cloud backup targets can be configured with immutability.

At minimum, you should verify that backup jobs complete successfully every day and perform a full test restore of critical systems at least quarterly. Automated recovery verification built into modern backup platforms performs synthetic restore tests against each recovery point and alerts on failures without requiring manual intervention. Annual or semi-annual tabletop disaster recovery exercises that walk through the full recovery procedure are also recommended to validate that your team knows what to do and that the documented process actually works.