Do Cloud Backup Services Meet 3-2-1 Compliance?

Cloud backup services like Veeam, have a lot going for them as backup and disaster recovery (DR) targets. In fact, some in the backup community say that using only a cloud backup solution is enough to meet the 3-2-1 rule (three copies of the data in two different media with one offsite). There is a healthy debate about if this statement is valid, but one thing that is certain, the cloud backup industry is involved in more and more business every day. 

Cloud Backup Services are Growing

According to the Veeam 2021 Data Protection Report, the percentage of data protected by traditional, self-managed on-premises systems fell from 40% in 2020 to 34% in 2021. And by 2023, it is anticipated to fall even further to 19%. Meanwhile, self-managed cloud-based backup is growing, from 30% in 2020 to 35% by 2023. 

The fastest growing category is cloud backup managed by a service provider. In 2020, 29% of data was protected this way. By 2023, it’s expected to increase to 46%.

Cloud Backup Solutions: Inexpensive & Accessible

The cloud has a lot going for it. For starters, it’s inexpensive to store data, and that data is accessible from anywhere. The largest hyperscale clouds have a highly redundant architecture that copies data in multiple places throughout its infrastructure. And, of course, the cloud is a very easy way to get a backup offsite. After all, the traditional method of copying backups to tape or disk and then trucking them off to some offsite storage facility is no cinch. They’re slow, as well. If you need to access these offsite tape backups, you’d have to have them delivered to you, which could take a day or two. If it’s much faster than that, your offsite backups are probably too close for comfort. Any regional disaster like a hurricane, earthquake or flood that takes out your primary data center would also likely take out your backups as well. 

With the cloud backup services, your data copies are likely hundreds of miles away. And, unless you’re putting them into a cold storage service like Amazon Glacier, they’re readily accessible. Even if they are in cold storage, they’re accessible in 12 or 48 hours, depending on the level of service. Even better, if your data center is destroyed, you can always spin up your backups in cloud compute … so long as you have the skills to do so.

How Does the Cloud Stack Up Against 3-2-1?

The Cloud is not a foolproof solution and anyone who jumps headfirst into cloud backup solutions without fully thinking it through may find themselves in a real mess when they need to begin cloud disaster recovery. So let’s take each of the three parts of the 3-2-1 rule and see if the cloud, alone, fulfills them all.

Three copies of the data

Technically, the cloud does fulfill this point. One copy is the production data itself, and the cloud copies all data to multiple locations within its infrastructure. So, yes, there are at least three copies. But does it fulfill the spirit of 3-2-1? 

The point of having three copies is to decrease your risk, and from that standpoint, the cloud can’t really count as multiple copies, unless you’re storing them in two different geographies or two different clouds. After all, while cloud outages aren’t very common, they do occur.

Yes, data loss in the cloud is vanishingly rare, but can you really afford putting all your eggs in one basket, hoping that you never need to restore a backup during an outage? Hope is not a plan, and this is why the 3-2-1 rule requires three copies of your data. 

Two different media

Again, technically, the cloud does meet this criteria, but only if you’re counting your production data as one type of media. Many backup professionals see this as bad practice. If you’re going to have a third copy in addition to the production and cloud-based data, then you will almost certainly have it in a different form of media. 

Truth be told, it’s a good idea to have at least one backup copy stored locally. After all, what if you lose your Internet connection? Even if the cloud is up, it won’t do you any good if you can’t access it. Having a local copy on tape, disk, optical drive or any other media will enable you to restore in the event of a cloud outage. A local copy is also useful if you’re dealing with very large datasets. Downloading large backups from the cloud will take a while, and you’ll also have to pay potentially expensive cloud egress fees. 

One Offsite

Ok, here, the cloud has got you covered. It’s an ideal place to store a copy offsite. However, unless you have planned for it and have a robust skillset, it’s not a good idea to restore to the cloud in the event that a server or, knock on wood, your entire data center is no longer a viable restore target. Getting your virtual machines (VMs) and all their dependencies running in the cloud requires preparation and domain expertise. And then there’s the issue of making sure everyone can access these newly restored VMs.

If you’re thinking about restoring to the cloud, you’ll do a lot better to work with a backup-as-a-service (BaaS) or DR-as-a-service (DRaaS) provider. 

The Cloud And Correct Media Offer Complete Solution

The cloud is an excellent component of any 3-2-1 backup infrastructure, but the cloud, alone, may leave you with more risk than is acceptable. Follow the spirit, not the letter of 3-2-1, and you’ll be in a much better position to deal with whatever the world throws at you.

Learn more about backups and the 3-2-1 rule in our free e-book, “The Veeam 3-2-1 Data Protection Blueprint: Offsite Backup, Disaster Recovery & The Cloud”

Share this on:
Featured Resource
Get Pricing
Skilled in all things IT

Easy to Try, Easy to Buy

Use our pricing calculator to determine the right solution for your needs.


Type and hit ‘Enter’ to search.