The classic 3−2−1 rule was the gold standard for data protection for decades: three copies of data, on two different media types, with one copy off-site. The problem in the ransomware era: all three copies can be network-reachable. An attacker with domain administrator rights destroys all of them within hours.

Security architects and the BSI therefore recommend extending to the 3−2−1−1−0 rule:

The first ‘+1’ requires that at least one copy is offline or air-gapped — not merely logically isolated, not just firewall-protected, but physically non-addressable. This is the air gap layer that remains intact even when an attacker has gained full domain administrator rights.

The ‘+0’ (zero errors after verification) requires that backups are regularly tested for recoverability. A backup without a verified restore is not a backup — it is an assumption. Recovery tests must be timed and documented. BSI CON.3.A11 requires regular recovery tests; NIS2 requires their documentation.

The 3−2−1−1−0 strategy is the minimum requirement for organizations that must be NIS2- or KRITIS-compliant. The concrete architecture is typically structured in tiers: Tier 1 (primary online backup), Tier 2 (air gap layer), Tier 3 ( long-term archive) and optionally Tier 4 (geographic redundancy).

Frequently asked questions

Not for ransomware protection. All three copies of the 3-2-1 rule can be network-reachable — an attacker with admin credentials destroys them all together in an emergency. The 3-2-1-1-0 extension adds the critical layer: one physically unreachable copy. That is the difference between a backup that protects after an attack and one that was destroyed together with the production environment.
The '0' stands for 'zero errors after verification'. Backups must be regularly tested for actual recoverability. Not just 'the job ran through and the logs are green', but: 'we fully restored from this backup and it took X hours.' Only then is the RTO proven.