---
title: 3-2-1-1-0 Backup Rule
date: 2026-06-01T17:19:00+02:00
author: Hannes Heckel
canonical_url: "https://www.fast-lta.de/en/glossary/3-2-1-1-0-backup-rule"
section: Glossar
---
The classic 3−2−1 rule was the gold standard for data protection for decades: three copies of data, on two different media types, with one copy off-site. The problem in the ransomware era: all three copies can be network-reachable. An attacker with domain administrator rights destroys all of them within hours.

Security architects and the BSI therefore recommend extending to the 3−2−1−1−0 rule:

The first ‘+1’ requires that at least one copy is offline or air-gapped — not merely logically isolated, not just firewall-protected, but physically non-addressable. This is the air gap layer that remains intact even when an attacker has gained full domain administrator rights.

The ‘+0’ (zero errors after verification) requires that backups are regularly tested for recoverability. A backup without a verified restore is not a backup — it is an assumption. Recovery tests must be timed and documented. BSI CON.3.A11 requires regular recovery tests; NIS2 requires their documentation.

The 3−2−1−1−0 strategy is the minimum requirement for organizations that must be NIS2- or KRITIS-compliant. The concrete architecture is typically structured in tiers: Tier 1 (primary online backup), Tier 2 (air gap layer), Tier 3 (WORM long-term archive) and optionally Tier 4 (geographic redundancy).

### WORM

WORM (Write Once, Read Many) refers to a storage principle in which data is written once and can technically no longer be altered or deleted — in hardware WORM, this immutability is a physical property of the storage controller, independent of software, operating system or user privileges.

[Mehr erfahren →](https://www.fast-lta.de/en/glossary/worm)

 

## Frequently asked questions

 #### Is the classic 3-2-1 rule still sufficient today?

Not for ransomware protection. All three copies of the 3-2-1 rule can be network-reachable — an attacker with admin credentials destroys them all together in an emergency. The 3-2-1-1-0 extension adds the critical layer: one physically unreachable copy. That is the difference between a backup that protects after an attack and one that was destroyed together with the production environment.

#### What does the '0' in 3-2-1-1-0 mean?

The '0' stands for 'zero errors after verification'. Backups must be regularly tested for actual recoverability. Not just 'the job ran through and the logs are green', but: 'we fully restored from this backup and it took X hours.' Only then is the RTO proven.