3-2-1 backup: protecting a NAS or Veeam environment

The 3-2-1 rule in practice

Keep at least three copies of the data, on two types of media, with one copy off site. The 3-2-1-1-0 variation adds an offline or immutable copy and targets zero errors during recovery testing.

Synchronization is not backup

A deleted, encrypted or corrupted file may be immediately replicated to a synchronized destination. A real backup retains multiple restore points and limits the ability of a compromised account to erase history.

Copy 1: production data

This may include virtual machines, physical servers, a Synology, QNAP, TrueNAS or Unraid NAS, or Microsoft 365 data. Identify owners, criticality and data volume before selecting tools.

Copy 2: fast local backup

A local target supports fast recovery. With Veeam, this may be a hardened Linux repository, dedicated storage or a purpose-built backup appliance. For a home NAS, a second volume or device can be the first destination when access rights are properly isolated.

Copy 3: off site and isolated

• Replication to a controlled secondary location.
• Object storage with immutability when supported by the service.
• Disconnected media rotated according to a documented procedure.

Protect the backup platform

Separate administrative accounts, enable multifactor authentication, restrict network access and prevent a domain administrator from automatically deleting every copy. Platform logs and alerts should also be monitored.

Define RPO and RTO

RPO describes the amount of data the organization can afford to lose; RTO defines the acceptable time to restore service. These objectives determine backup frequency, storage type and required budget.

Test instead of assuming

• Regularly restore a file, a virtual machine and a complete application.
• Verify the accounts, keys and procedures required during an incident.
• Document actual recovery time and address gaps against the expected RTO.

The right measure of success

Job success rates are not enough. A backup strategy is credible when data is recoverable, copies withstand compromise of the primary environment and the team can execute the plan.