Veeam’s ransomware research found that attackers went after backup repositories in 96% of incidents — and got to them roughly three times out of four. Organizations whose backups were compromised faced recovery costs around eight times higher than those whose backups survived. That gap is the entire argument for the 3-2-1-1-0 backup rule. The old 3-2-1 rule assumed your backups fail by accident. The two new digits assume they fail because someone with domain admin credentials wanted them to.
This guide maps each digit to a real 2026 implementation — not the whiteboard version. The short version: the “+1” means an immutable copy an attacker cannot alter even with your credentials, the “0” means recovery you have actually verified, and immutability is not the same thing as an air gap, no matter how many vendor decks conflate the two.
What the digits actually require
| Requirement | 2026 implementation | |
|---|---|---|
| 3 | Three copies of the data | Production + primary backup + a copy job to a second target |
| 2 | Two different media or platforms | Disk repository plus object storage, tape, or a different failure domain — not two LUNs on one array |
| 1 | One copy offsite | Cloud object storage, a second data center, or a managed vault |
| +1 | One copy immutable or air-gapped | S3 Object Lock in compliance mode, a hardened appliance, or offline tape |
| 0 | Zero errors on verified recovery | Automated restore testing — Veeam SureBackup, Rubrik recovery validation, or scripted sandbox restores |
The takeaway for the meeting: 3-2-1 protects you from hardware and human error; the +1 protects you from an attacker; the 0 protects you from your own untested assumptions. Most shops I talk to have the first three digits and neither of the last two.
3-2-1: the part you probably already do
Three copies, two media, one offsite has been table stakes since tape libraries were the interesting part of the data center. Two honest checks are still worth running. First, “two media” means two failure domains — a backup repository sitting on the same SAN as production, or in the same vSphere cluster, is one ransomware event away from being zero copies. Second, “offsite” must mean a separate administrative domain, not just separate geography. A DR site joined to the same Active Directory forest with the same admin credentials fails exactly when you need it. If your offsite copy can be deleted from the same console that manages production backups, you have distance, not separation.
The +1: immutable is not air-gapped
Most content ranking for this term treats “immutable” and “air-gapped” as synonyms. They are different controls with different failure modes, and a mature program eventually wants both.
Immutability is a software or firmware guarantee that written data cannot be modified or deleted for a retention window — S3 Object Lock in compliance mode is the reference implementation. It is online, fast to restore from, and cheap to operate. Its weakness is that it is only as strong as the platform enforcing it: governance-mode locks that privileged accounts can lift, retention windows set shorter than attacker dwell time, or a storage admin account that can destroy the whole bucket’s account-level container. Compliance mode, MFA on the storage plane, and retention at least as long as your threat-hunting lookback are the minimum bar.
An air gap is a network or physical separation — offline tape, removable media, or storage that is only reachable during controlled windows. It survives platform compromise entirely, but restores are slow, testing is awkward, and “logical air gaps” that amount to a firewall rule deserve skepticism. Verdict: run immutable object storage as your working +1, and add a true offline copy for the crown-jewel 5–10% of data where a multi-week outage is existential. If you can restore from it in minutes, it is not an air gap — and that is fine, as long as you stop calling it one.
Building the immutable copy: Veeam, Object First, Wasabi, Rubrik
Four approaches dominate the conversations I see in mid-market and enterprise accounts. They are not interchangeable.
Veeam: assemble the stack yourself
Veeam Data Platform gives you three routes to the +1: a hardened Linux repository with immutability flags, direct-to-object backups against any Object Lock-capable S3 target, and Veeam Data Cloud Vault, its managed cloud storage with immutability and egress bundled into a flat per-terabyte price. SureBackup covers the 0 by booting workloads in an isolated lab and running verification tests. Strengths: flexibility and the largest ecosystem of Veeam Ready storage targets. The honest downside is that Veeam sells you the software and the responsibility — a hardened repo is only hardened if your team actually locks down SSH, patches the box, and resists the temptation to join it to the domain. The 96%-of-attacks statistic comes from Veeam’s own incident research; the company is clear-eyed that its customers’ repositories are the target.
Object First: turnkey on-prem immutability for Veeam shops
Object First’s Ootbi appliance exists to remove that operational burden. It is S3 Object Lock storage that ships immutable by default with a zero-access design — no root shell for an attacker to find, no immutability toggle for a rushed admin to disable. As of mid-2026 the appliance line spans roughly 20 TB to 432 TB per node and clusters into the petabyte range, with ingest fast enough to serve as the primary backup target, not just a copy tier. The fit is narrow and deliberate: Ootbi only speaks Veeam. If you run Commvault or Rubrik alongside, it does nothing for those workloads, and you are paying appliance margins over commodity disk. For a Veeam shop that wants on-prem immutability without a hardening project, it is the shortest path.
Wasabi: the cheap immutable offsite tier
Wasabi’s pitch is economic: hot cloud object storage with full Object Lock support, Veeam Ready certification for immutability, flat per-terabyte list pricing, and no egress fees — which matters enormously the day you restore 200 TB in anger. It is an excellent answer for the “1 offsite” and “+1 immutable” digits in a single move. The limits: Wasabi is storage only, so restore speed is bounded by your internet pipe, and minimum-retention billing means churny short-retention jobs cost more than the headline rate suggests. Model your restore-time math before you rely on it as the only immutable copy; our backup storage cost-per-TB analysis runs those numbers across the major targets.
Rubrik: immutability as architecture
Rubrik takes the opposite approach from the assemble-it-yourself model: its append-only filesystem is immutable by design, not by configuration, so there is no setting to get wrong. Rubrik Security Cloud layers on anomaly detection, threat hunting across backup history, and orchestrated recovery validation — effectively bundling the +1 and the 0 into the platform. The trade-offs are real: it is a platform replacement rather than a bolt-on, pricing sits at the premium end, and you are committing to one vendor’s stack for backup, immutability, and security analytics together. For organizations that want the rule enforced by architecture rather than by process discipline, that bundle is exactly the point.
For a deeper side-by-side of these targets — including hardened repos, tape, and the hyperscaler options — see our immutable backup storage comparison.
The 0: verified recovery, not green checkmarks
A successful backup job proves data was written. It proves nothing about whether the application boots, the database mounts, or the restore completes inside your RTO. The 0 digit demands automated, scheduled verification: Veeam SureBackup boots VMs in an isolated network and runs heartbeat, ping, and custom application tests; Rubrik and others offer equivalent recovery validation and clean-room recovery workflows. The benchmark I hold clients to: every tier-1 workload restore-tested at least quarterly, automated verification running weekly, and at least one full DR exercise a year that the infrastructure team does not schedule themselves. If your last full restore test predates your last major hire, you do not have a 0 — you have a hope. Regulated shops should map this cadence to their obligations; our DR testing cadence guide for DORA covers what supervisors now expect in writing.
What to do about it
- This month: inventory which digits you actually have. Check every immutability setting — compliance mode or it does not count. Verify the backup platform has its own identity plane, separate credentials, MFA everywhere.
- This quarter: stand up one genuinely immutable copy — Object Lock bucket, Ootbi node, hardened repo, or a managed vault — and set retention longer than 30 days, since attacker dwell time routinely exceeds short lock windows.
- This half: automate recovery verification for tier-1 workloads and put the results in front of leadership monthly. The 0 is a reporting artifact as much as a technical one.
- Ongoing: add an offline or truly isolated copy for existential data, and rehearse restoring from it once a year.
The rule is cheap insurance against an expensive certainty. Attackers already treat your backups as the primary target; 3-2-1-1-0 is simply the posture that assumes they will.
Frequently asked questions
What is the 3-2-1-1-0 backup rule?
Keep three copies of your data on two different media with one copy offsite, plus one copy that is immutable or air-gapped, and verify recovery with zero errors. The last two digits extend the classic 3-2-1 rule for ransomware, where attackers deliberately destroy backups before encrypting production.
Is an immutable backup the same as an air-gapped backup?
No. Immutability is a software guarantee that data cannot be changed or deleted during a retention window; an air gap is physical or network isolation. Immutable storage is online and fast to restore from but depends on the platform enforcing it. An air gap survives platform compromise but restores slowly. Mature programs use immutable storage as the working copy and reserve a true offline copy for critical data.
Does the 3-2-1 rule still apply in the cloud?
Yes, and SaaS data counts too. A cloud workload backed up to the same cloud account is one compromised credential away from total loss. Cross-account or cross-provider copies with Object Lock — for example, Veeam writing to Wasabi or to Veeam Data Cloud Vault — satisfy the offsite and immutable digits without a second data center.
How often should backups be tested?
Automated verification weekly, restore tests for tier-1 workloads at least quarterly, and a full DR exercise annually. Tools like Veeam SureBackup or Rubrik’s recovery validation make the weekly cadence practical by booting and testing workloads automatically in an isolated environment.
Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.