Immutable Backup and the 3-2-1-1-0 Rule

Immutable Backups and the 3-2-1-1-0 Rule Explained — cover illustration

Key takeaways

3 copies, 2 media, 1 off-site, 1 immutable or offline, 0 restore errors.
Immutability prevents deletion or change for a defined retention period.
Separate backup credentials from production identity.
Verified restores matter more than backup success reports.

The 3-2-1-1-0 rule

Element	Meaning
3	Three copies of data — production plus two backups
2	Two different media or storage types
1	One copy off-site
1	One copy immutable or offline
0	Zero errors in verified restore tests

What immutability means

Immutable storage prevents data from being changed or deleted for a set retention period, even by administrators. Options include object storage with object lock, hardened Linux repositories, purpose-built backup appliances and tape kept offline.

Protecting the backup platform

Separate administrative accounts, ideally in a separate identity domain.
MFA on backup consoles.
Network isolation for backup infrastructure.
Alerts on retention changes and mass deletions.
Encryption of backups at rest and in transit.

Verifying restores

Automate restore testing where possible — boot backed-up virtual machines in an isolated network and check that applications start. Record results as evidence.

Clean recovery

After ransomware, restoring the latest backup may restore the attacker's foothold. Scan backups for indicators of compromise, use an isolated recovery environment and rebuild identity services from trusted media.

Compliance

ISO 27001, SOC 2 and cyber insurers expect tested backups; immutable, verified backups provide strong evidence.

Choosing immutable storage

Option	Strengths	Considerations
Object storage with object lock	Scalable, cloud or on-premises	Configure compliance mode correctly
Hardened Linux repository	Cost-effective, flexible	Requires strict hardening and access control
Purpose-built appliance	Integrated, simple	Vendor lock-in
Tape (offline)	True air gap, low cost per TB	Slower restores

Retention design

Balance recovery needs against cost. Daily backups retained for a month, weekly for several months and monthly for a year is a common baseline, adjusted for legal requirements. Keep immutable retention long enough to cover attackers' dwell time.

Backup monitoring

Monitor job success, capacity, immutability settings and unusual changes in backup size or change rates, which can indicate encryption in progress.

How NAZZTEC helps

We design and implement backup architectures with immutability, isolated recovery environments and automated restore testing, and can manage backup operations as a service.

Next step: see Business Resilience Solutions and Data Center Services.

Frequently asked questions

Is cloud backup automatically immutable?

No. Immutability must be configured, for example using object lock in compliance mode.

How long should backups be retained?

Based on legal, regulatory and business needs; keep at least enough history to recover from attacks discovered weeks later.

Does replication count as backup?

No. Replication copies corruption and encryption immediately; it complements backup but does not replace it.

NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.

Immutable Backups and the 3-2-1-1-0 Rule Explained