One copy is a hope, two copies on the same disk are one failure, and three copies in the same building are one fire. The rule exists to separate the failure modes: production plus two backups, different storage (not the same RAID), and one physically elsewhere — the cloud counts if it is genuinely elsewhere.
The rule says nothing about restores, which is where most backup strategies quietly fail: a backup you have never restored from is a hypothesis. The scheduled restore drill — pick a file, pick a server, put it back — is what turns the rule into a fact.
Related terms
Ransomware
Malware that encrypts your files and sells the key back to you — the attack where your backups decide whether it is a bad week or a closed business.
Incident response
The plan and the practice for what happens between noticing something is wrong and being back to normal.
GDPR
The EU's data-protection regulation — consent before collection, rights to access and deletion, breach notification in 72 hours, fines up to 4% of turnover.
The bench this belongs to
CybersecurityPurple Team: the same person writes the exploit and closes the hole. Most agencies only harden, which means hardening against a threat nobody tested.
