The 3-2-1-1-0 backup rule: where do you stand?

Ransomware now goes after backups first. A copy reachable from the production network can be encrypted or deleted along with everything else. The 3-2-1 rule has therefore evolved.

The rule in plain words

• 3 copies of your data: production plus two backups.
• 2 different media or technologies.
• 1 off-site copy, in another location or in the cloud.
• 1 immutable or offline copy, which cannot be changed or deleted, even with administrator rights.
• 0 errors: restores tested regularly and verified.

Five questions to ask yourself

Do you know how long a full restore of your main server would take? Are your backup credentials separate from your directory credentials? Is one of your copies truly immutable? When did you last test a restore? Who is alerted when a backup fails?

If even one answer makes you hesitate, your setup deserves a check. It is one of the things I systematically verify as part of my managed services.