Skip to content

Article ·

The 3-2-1-1-0 rule: backups that survive ransomware

A backup you have never restored is not a backup. And with modern ransomware hunting down and deleting backups before it encrypts, the classic rule is no longer enough on its own.

The problem

Attackers start with your backups

In many ransomware attacks, the attacker is inside the network days or weeks before encrypting, looking for the backup servers and their accounts. If the backups sit on the same network under the same admin credentials, they are deleted or encrypted first, and the organization loses its way back.

The rule

What 3-2-1-1-0 means

An extension of the familiar 3-2-1 rule that adds two conditions aimed squarely at ransomware:

  • 3 copies of your data: the original and two backups.
  • 2 different types of storage media.
  • 1 copy off-site.
  • 1 copy that is immutable or offline.
  • 0 errors after verified restore testing.

In practice

A checklist for your IT team

Start with these points, then measure readiness by actual restore time, not by successful backup jobs.

  • An immutable backup repository that even an administrator cannot delete during the retention period.
  • Separate backup admin accounts with multi-factor authentication, outside the main Active Directory.
  • Regular restore tests of critical systems, with the restore time recorded.
  • Agreed recovery time (RTO) and recovery point (RPO) objectives for each system.
  • Microsoft 365 data in scope: it is not fully backed up by default.

Compliance

Backup is part of the national controls

The NCA Essential Cybersecurity Controls (ECC) include a dedicated component for backup and recovery management, including periodic testing of recovery effectiveness. Applying the rule above and documenting the test results makes compliance easier to demonstrate at audit time.

Are your backups ready for attack day?

We review your current backup environment against the 3-2-1-1-0 rule and recommend what is needed: an immutable repository, separated credentials, a restore-testing plan and Microsoft 365 backup.

Request a backup review
All insights