What is the 3-2-1 backup rule?

CISA's Data Backup Options paper states it this way: keep 3 copies of any important file (1 primary and 2 backups), keep the files on 2 different media types to protect against different types of hazards, and store 1 copy offsite, outside your home or business facility.

Is RAID or a NAS a backup?

No. RAID keeps an array running when a drive fails. It does not protect against a deleted folder, a corrupted project, ransomware or a fire, because all of those affect every drive at once. A NAS can be the primary copy or one backup target, but it needs separate backup copies as well.

How often should I test a restore?

Right after you set the backup up, then on a schedule that fits how fast your files change. Studios whose files change every day often spot-check monthly and restore a whole project quarterly. CISA's #StopRansomware Guide advises testing backup procedures on a regular basis. The plan on this page gives a schedule for your answers.

Is a cloud backup enough for a video studio?

It makes a good offsite copy, but restoring a large data set over the internet is slow. At 300 Mbps with 10% overhead, 20 TB takes close to 7 days to download. Many studios keep a local copy for fast recovery and use the cloud as the offsite copy. The planner shows restore times for your numbers.

What is an offline backup and why does it matter?

It is a copy that is disconnected or otherwise out of reach of the studio network, such as drives taken off site or tape. Ransomware that reaches the network can encrypt backups that stay connected. CISA's #StopRansomware Guide recommends maintaining offline, encrypted backups of critical data.

Plan a 3-2-1 backup for your studio

Tell us how much data you protect, how often it changes, where you work and how fast you need to recover. This planner returns a plain-language 3-2-1 backup plan: which copies to make, how often, what to check, and a schedule for testing a restore. It prints cleanly, so you can pin it up.

The numbers you type stay in your browser and in the page address. Nothing reaches us unless you send the request form at the end.

Quick answer

The 3-2-1 rule, as CISA states it: keep 3 copies of any important file (1 primary and 2 backups), on 2 different media types, with 1 copy offsite. Then test restoring from it, because a backup you have never restored is a guess. Enter your numbers below for a plan that fits your studio.

Your data

Data to protect

Everything you cannot afford to lose: footage, projects, exports.

How often do files change?

Every working dayActive projects are edited, added to or exported daily.Every week or soFiles change in bursts, then sit for a while.RarelyMostly finished work that is kept for reference.

Locations where people work or data lives

OneTwoThree or more

Budget and recovery

Budget comfort

TightSpend as little as possible and still be safe.ModerateA sensible spend is fine if it is worth it.FlexibleSafety and speed of recovery matter more than cost.

How fast must you be working again after a loss?

The same working dayWork stops until files are back.Within two or three daysA short stop is painful but survivable.Within a weekYou can wait, or rebuild from other sources.

Offsite options

Which offsite copy could you use?

Cloud object storageFiles are copied over the internet to a provider's storage.A second siteA copy at another office, a partner's space or a home office you control.Tape or offline drivesDrives or tapes that are taken away or kept disconnected.

Pick none and the plan suggests a starting point for your budget.

Internet upload

Internet download

Used for restore times.

3-2-1 backup plan from cloudsagency.co/studio-it/tools/backup-planner

Your 3-2-1 plan

3 copies, 2 media types, 1 offsite

Back up 20.0 TB with three copies (1 primary and 2 backups) on at least two kinds of storage, one of them offsite. Back up every night, and test a restore on a schedule.

You chose cloud object storage.

Gaps in this plan

None of the copies is offline. Ransomware that reaches the studio network can encrypt backups that stay connected, so consider one offline or write-protected copy, as CISA advises.

The three copies

Copy 1: Primary copy
Your working storage, such as the NAS or server the team edits from.
Storage type: Disk array on shared storage. When: Live
The copy everyone works from. RAID protects against a failed drive, but it is not a backup.
Copy 2: Local backup
A separate device in the building, such as a second storage unit or external drives, on its own login and not mounted for everyone.
Storage type: Separate disk device (a different kind of device from the primary where you can). When: Every night, as an incremental backup that copies only what changed.
The fast restore. When a drive fails or someone deletes a folder, this is where files come back from in hours rather than days.
Copy 3: Offsite backup
Cloud object storage, with encryption on and a separate login that is not used day to day.
Storage type: Cloud storage. When: Every night if the connection allows it, otherwise at least weekly.
The copy that survives a fire, a flood, a theft or ransomware that reaches everything on the studio network.

If something goes wrong between backups you could lose up to about a working day of changes. Run backups more often if that is too much.

What to do, in order

Set up the local backup and the offsite copy in the same week, so no data is left with a single copy for long.
Add the offline copy and the failure alerts next.
Run the first restore test before you call it done.

How long a restore could take

For all 20.0 TB. Your need: back to work within two or three days (about 72 hours).

Estimated time to restore all data from each copy
Restore from	About	Meets your need?
Local backup over 1 gigabit Ethernet	2 days 2 h	Yes, on paper
Local backup over 10 gigabit Ethernet	5 h 3 min	Yes, on paper
Cloud copy over your internet	6 days 20 h	No, for the full set

These are ceilings worked out from line speed. A real restore is usually slower, because of the backup tool, many small files, disk speed and other traffic.
You rarely restore everything at once. Restore the active projects first and the archive later, which is much faster than the full-set figures here.
The cloud copy alone cannot meet your recovery need for the whole data set at your internet speed. Keep a local copy for fast recovery and treat the cloud copy as the last resort.
The first full upload would take about 58 days 18 h at 35.0 Mbps. That is long enough to consider sending the first copy on drives, or sending the active projects first and the archive later.

Test your restore

A backup you have never restored is a guess. Put these in the calendar with a name next to each.

Schedule for testing a restore
When	What to do	It passes when
Right after you set it up	Restore one file and one whole folder from each copy, and open them.	The files open and match the originals.
Every month	Restore a recent project to a different computer. Open it in the editing app and play it through.	Media links are intact and playback is clean.
Every quarter	Restore your largest active project from the offsite copy and time it.	The time is within what you said you can wait.
Once a year	Pretend the main storage is gone. Write down the steps, restore the critical projects and record how long it took.	Anyone on the team can follow the written steps.
After any change	After a new storage device, a new backup tool, a new provider or a changed password, restore one file again.	The restore still works.

Where the rule comes from

CISA, Data Backup Options (the 3-2-1 rule). States the rule as: keep 3 copies of any important file (1 primary and 2 backups), on 2 different media types, with 1 copy offsite.
CISA, #StopRansomware Guide. Recommends maintaining offline, encrypted backups of critical data and testing backup procedures on a regular basis.

Assumptions

What this tool takes for granted. If one of these is wrong for you, treat the result accordingly.

The plan follows the 3-2-1 rule as written by CISA in Data Backup Options. CISA's #StopRansomware Guide adds offline, encrypted backups and regular testing. Both are linked below.
The budget choice is a band, not a price. It only changes which steps come first. The planner never names products and never states prices.
Restore times are ceilings worked out from line speed: 110 MB/s for 1 gigabit, 1,100 MB/s for 10 gigabit, and your internet download speed less 10% overhead. Real restores are usually slower.
The first upload to an offsite copy uses your upload speed less 10% overhead, and later backups send only what changed.
Copies are assumed to hold the same data as the primary. If you back up only active projects offsite, the sizes and times shrink.
This is a planning aid. It does not know your software, your contracts or your clients' rules, so check those before you rely on it.

Want a person to set it up? Plug us in.

Tell us what you see on screen. A person on our production consulting team reads it and replies, usually with the first thing to check.

What each number in 3-2-1 means

Three copies means the working files plus two backups, so a single failure never leaves you with nothing. Two media types means the copies do not all sit on the same kind of storage, because one kind of hazard, such as a bad batch of drives, can affect them all. One offsite copy means a fire, flood, theft or ransomware at the studio cannot reach every copy.

Newer guidance adds offline copies. Ransomware that reaches the studio network can encrypt a backup that stays connected, so CISA advises keeping offline, encrypted backups of critical data.

Why you test a restore

Backups fail quietly: a job stops, a password expires, a folder was never included. The only proof is restoring something and opening it. The schedule in the plan starts with a quick test on the day you set it up, then repeats at a pace that fits how fast your files change. CISA's guide says the same in fewer words: test backup procedures on a regular basis.

Questions about 3-2-1 backups

What is the 3-2-1 backup rule?: CISA's Data Backup Options paper states it this way: keep 3 copies of any important file (1 primary and 2 backups), keep the files on 2 different media types to protect against different types of hazards, and store 1 copy offsite, outside your home or business facility.
Is RAID or a NAS a backup?: No. RAID keeps an array running when a drive fails. It does not protect against a deleted folder, a corrupted project, ransomware or a fire, because all of those affect every drive at once. A NAS can be the primary copy or one backup target, but it needs separate backup copies as well.
How often should I test a restore?: Right after you set the backup up, then on a schedule that fits how fast your files change. Studios whose files change every day often spot-check monthly and restore a whole project quarterly. CISA's #StopRansomware Guide advises testing backup procedures on a regular basis. The plan on this page gives a schedule for your answers.
Is a cloud backup enough for a video studio?: It makes a good offsite copy, but restoring a large data set over the internet is slow. At 300 Mbps with 10% overhead, 20 TB takes close to 7 days to download. Many studios keep a local copy for fast recovery and use the cloud as the offsite copy. The planner shows restore times for your numbers.
What is an offline backup and why does it matter?: It is a copy that is disconnected or otherwise out of reach of the studio network, such as drives taken off site or tape. Ransomware that reaches the network can encrypt backups that stay connected. CISA's #StopRansomware Guide recommends maintaining offline, encrypted backups of critical data.

More free tools

Related guides

Browse the Studio IT hub for more fixes, or see IT for small creative studios. We are in Los Angeles and help studios remotely across the US with remote editing setup, shared storage and NAS, backups, and security and onboarding.