The 3-2-1 rule is the universal baseline of data protection: 3 copies (production + 2 backups), on 2 different media types (to avoid the same failure), with 1 kept off-site — typically in a second data center.
The ransomware-hardened version is 3-2-1-1-0: the added 1 requires an immutable or offline copy (immutable = unchangeable for a set period, WORM; air-gap = physically isolated), and the 0 requires zero verified restore errors — because a backup that is never tested is not a backup.
It is the building block of a real BCP/DRP: the off-site copy becomes the starting point of recovery on another site, with a measurable RTO/RPO. Without an immutable off-site copy, ransomware or a single disaster wipes out everything.