The 3-2-1 backup rule, updated for the cloud era

The 3-2-1 rule is older than cloud computing. It still works. What has changed is what counts as a "copy," what counts as "media," and what "offsite" means when your primary data lives in someone else's data center.

The 2026 implementation

• Copy 1: Production data in M365, your line-of-business app, or on-prem servers.
• Copy 2: A backup product capturing change-block-level snapshots, often hourly.
• Copy 3: An offsite copy in a different cloud or region, ideally in immutable storage so ransomware cannot encrypt it.

The trap of "Microsoft backs up M365 for me"

They do not, at least not in the way you need. Read the shared responsibility model. Then back up your tenant.

Test restores or it didn't happen

The most common backup failure is not the backup. It is the restore. Quarterly fire drills with documented runbooks turn theoretical resilience into actual resilience.