The 3-2-1 backup rule for small businesses, and why ransomware calls for 3-2-1-1-0

“Don’t worry, we have backups.” It is often the first thing said on the morning of a ransomwareRansomwareMalware that encrypts an organisation’s data and demands a ransom to restore it, often also threatening to publish the stolen data. attack. Then comes the bad news: the backup NAS, plugged into the network and managed with the same account as the servers, was encrypted along with them. Or the backup existed, but nobody had ever tried to restore it.

Written for managers and IT leads in small businesses, this guide explains the 3-2-1 rule3-2-1 backup ruleA simple backup rule: 3 copies of your data, on 2 different types of media, with 1 kept off-site., its stronger 3-2-1-1-0 version, and how to check every quarter that your backups will actually save you.

The 3-2-1 rule and its stronger 3-2-1-1-0 version

The 3-2-1 rule fits in one sentence: three copies of your data, on two different types of media, with one off-site. The original counts as a copy, so you need two backups on top of your live data.

ANSSI, the French national cyber security agency, adopts the rule in its guide on backup fundamentals, with one change that matters: one of the two backups must be offline, on media disconnected from any IT system. The agency calls this offline copy “essential” (failing that, an online off-site copy under certain conditions), even if it is made less often than the daily backups.

The 3-2-1-1-0 variant, widely used by backup software vendors, spells out both requirements:

An immutable copy cannot be changed or deleted for a set period, not even by an administrator. ANSSI considers a truly offline copy more robust than online immutable storage, and suggests a sensible compromise: regular backups to immutable storage, plus a less frequent offline copy.

Why attackers go after your backups first

Encryption is the last step of an attack. Before it, the attacker seeks administrator rights, then sets out to neutralise your backups: without them, your only way out is to negotiate. ANSSI says so plainly: attackers frequently try to encrypt, delete or disable the backup infrastructure.

The Sophos survey quoted above shows what is at stake: 57% of those attempts succeeded, and victims whose backups were compromised were almost twice as likely to pay the ransom.

What to do with your backups during an attack (disconnect them, check they are clean before restoring) is covered in Ransomware attack: what to do in the first 72 hours.

RPO and RTO: two questions for the boss

Before choosing a tool, management needs to answer two questions for each activity. They have technical names, RPO and RTORTO and RPOThe RTO is the maximum acceptable downtime for a service; the RPO is the maximum amount of data, expressed as time, that you are prepared to lose when restoring.:

• RPO, recovery point objective: how many hours of work can you afford to lose? If the last backup ran last night, everything entered today is gone.
• RTO, recovery time objective: how long can you do without this tool before the damage becomes serious (lost customers, penalties, unpaid salaries)?

These numbers set frequency and budget, and feed your business continuity and disaster recovery planBusiness continuity (BCP / DRP)The business continuity plan (BCP) keeps essential activities running during a crisis; the disaster recovery plan (DRP) explains how to restart IT systems and recover data after a disaster.. Below 24 hours of acceptable loss, ANSSI notes, you need replication. On retention, the agency gives the example of 15 days of daily backups, 1 year of monthly ones and 5 years of yearly ones: an attacker can lie low for weeks, so you must be able to go back to before they arrived.

What to back up: the list people forget

Beyond file servers, people often forget:

• business databases (accounts, payroll, ERP, CRM), backed up in a consistent state;
• workstations if they hold documents, or else a rule that files live on the servers;
• configurations: firewalls, routers, the Active DirectoryActive Directory (AD)Microsoft’s directory service, which centralises the accounts, passwords and permissions of most corporate Windows networks: whoever controls it controls the whole network. domain, NAS, phone system;
• installation media and procedures: ANSSI asks you to back up whatever you need to rebuild the backup system itself (software, catalogue, import procedure, encryption keys);
• online services: email, file sharing, website, online business tools.

Microsoft 365 and Google Workspace: your provider does not back up everything for you

Microsoft and Google keep their services available. But Microsoft’s documentation on shared responsibility states that data, accounts and access remain the customer’s responsibility, SaaS included. And what is deleted or encrypted can only be recovered within strict limits:

• Microsoft 365: items deleted from SharePoint (and OneDrive for work or school files) stay in the recycle bins for 93 days, then disappear. Microsoft offers a paid option, Microsoft 365 Backup, whose copies stay inside the Microsoft 365 environment: to meet the “two media” and “off-site” parts of the rule, keep a copy elsewhere as well.
• Google Workspace: an administrator can recover Drive files within 25 days of the user emptying their bin; after that, Google purges them for good. Google Vault is for retaining and searching data for legal purposes, and Google states that Vault isn’t a data archive.
• Other online tools (CRM, accounting, e-signature): check that the contract allows a full, automatable export of your data.

Protecting the backup itself

A backup is a target. For a small business, five measures from ANSSI’s guide matter most.

1. An offline or immutable copy. An external drive unplugged and kept off-site, tape, or online storage locked for a set period. A plain network share or snapshots reachable from the network do not count.
2. Separate admin accounts. Backup servers should not belong to the production Active Directory domain, but have their own authentication, with dedicated, named admin accounts protected by multi-factor authenticationMulti-factor authentication (MFA)A login that requires at least two proofs of identity of different kinds (something you know, something you have, something you are), so that a stolen password is no longer enough. (see our article on MFA for small business). Where possible, separate the role that runs backups from the one that can delete copies.
3. EncryptionEncryptionA process that makes data unreadable to anyone who does not hold the right key, to protect its confidentiality while it is stored or transmitted., with keys kept safe. Above all, encrypt whatever leaves your premises or goes to the cloud, with your own keys, before upload. A lost key makes the backup useless: keep it in a password vault and in an offline copy.
4. Updates and monitoring. Patch the backup software and the NAS, and read the reports. An unusual volume, a disabled job or a shortened retention policy are warning signs.
5. A “red button”. During an incident, the priority is to isolate the backup infrastructure from the rest of the network. Decide in advance how: which cable, which switch, who is allowed to do it.

Which solution: a comparison

A small business usually combines a fast local copy with an offline or immutable off-site copy.

Testing restores: the “0” in 3-2-1-1-0

ANSSI and the US agency CISA agree: backups must be tested regularly. ANSSI adds that a restore procedure should be written down and regularly carried out. A simple plan is enough to start:

• every month: restore a few files and one mailbox, picked at random;
• every quarter: restore a full server or business database to a machine isolated from production, from the offline copy, with a stopwatch;
• every year: a tabletop recovery exercise with management, to agree the restart order.

Record each test on a one-page sheet:

Restore test · Q4 2026
Item tested       : file server, Accounts share
Restore point     : offline copy of 1 November, 22:00
Restored to       : isolated machine, no access to production network
Checks            : 20 random files opened, accounts database opened, permissions checked
Time taken        : 3 h 40 (RTO target: 4 h), passed
Issue found       : encryption key located after 25 min, procedure to be clarified
Signed off        : K. Diallo (IT), A. Morel (management)

The quarterly checklist

One review per quarter, with a short report to management:

• Every backup job this quarter succeeded, and volumes look consistent.
• New servers, workstations and online services are within the backup scope.
• The offline copy was made and stored off-site, or the immutable lock is active with the right duration.
• A full restore test was run, timed and compared with the RTO.
• The list of backup admin accounts is up to date, leavers removed, MFA active.
• Backup software, the NAS and their firmware are up to date.
• Encryption keys are accessible, backed up offline, and two people know how to use them.
• Retention lets you go back before an intrusion lasting several weeks.
• The printed restore procedure and emergency contacts are current.

That leaves one question: could an attacker reach your backups from a compromised workstation? That is exactly what KrakenShield’s non-destructive penetration test checks, carried out only with your written authorisation: see what we do. To place backups among all the defences against ransomware, read our chapter on ransomware.