Backups That Survive Ransomware: The 3-2-1 Rule and Why It Matters

CISA's #StopRansomware Guide explains in one sentence why ransomware backups have to sit out of the attacker's reach: "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid." A backup survives only if the attack can't touch it. The usual answer is the 3-2-1 rule: keep 3 copies of your data, on 2 different types of media, with 1 copy offsite. Against ransomware, that offsite copy also needs to be offline or immutable. A backup drive plugged into the same network as your main systems can be locked right alongside them.

What the 3-2-1 rule means

• 3 copies of your data: the live version plus at least two backups. With one backup, a single failure or a single encryption leaves you at zero.
• 2 different media types: for example, a local copy and a cloud copy, so one failure mode can't wipe every copy at once.
• 1 copy offsite: stored away from your main location and, against ransomware, out of the attacker's reach: offline, air-gapped, or in immutable storage that can't be altered or deleted even with your admin credentials.

Photographer Peter Krogh coined the name while writing the first edition of The DAM Book, a guide to managing digital photo archives. It was written for photographers guarding their work, not for businesses facing an attacker. Ransomware is what moved the weight onto the "1 offsite" part. Backup vendor Veeam now promotes an extended version, 3-2-1-1-0: one more copy that is immutable or air-gapped, and zero errors when recovery is verified.

Why a connected backup isn't protection

This is the mistake that turns a business with backups into a business paying a ransom. A drive plugged into a machine, a network share that's always mounted, a cloud folder that syncs instantly: anything running on your systems can reach all three, including ransomware. When the malware encrypts your files, it encrypts those too. A sync folder can make it worse by copying the encrypted files up and overwriting the good versions.

Convenience and protection pull against each other here. The easier a backup is for your systems to reach automatically, the easier it is for an attacker on those systems to reach. The Readiness Drill's playbook says it plainly: replication alone is not a backup, because it will faithfully copy encrypted or corrupted data forward.

Immutable storage has a price

Immutable storage can sound like the end of the problem. CISA's guide adds a caution: "Use immutable storage with caution as it does not meet compliance criteria for certain regulations and misconfiguration can impose significant cost." A copy nobody can delete is also a copy you can't delete when a retention rule says you should, and a lock set too long keeps billing you for storage you no longer want.

There is a second catch no lock can fix. An immutable copy faithfully preserves whatever was in the system when it was taken, including malware an attacker planted weeks before the encryption started. CISA warns that this leftover malware has to be found before you rebuild from backups. How far back your clean copies need to reach, and how long to keep them, is a judgment call with no universal answer. It depends on your data, your rules and how long an intruder could sit unnoticed.

Backups can fail silently

A backup job that "runs" is not the same as a backup you can restore. Jobs fail quietly: an error nobody reads, the wrong folder backed up for months, a job that stopped when a drive filled, a copy of the files without the database or settings needed to rebuild. Because nobody looks until they need one, the failure stays invisible until the worst possible moment. CISA's guide recommends regularly testing "the availability and integrity of backups in a disaster recovery scenario," and only a restore does that.

Test the restore, not just the backup

A green "backup successful" check tells you data was copied. It doesn't tell you the copy is usable. Rebuild the system from the backup in a safe environment, time it, and confirm it works. That's where you find out the backup was missing something critical, or that restoring takes far longer than you assumed. Do it on a schedule, because a backup that restored fine last quarter can break after a system change nobody accounted for.

The Readiness Drill scores the two halves separately. Immutable, isolated backups carry 18 of its 100 points. A timed end-to-end restore carries 22 and is a trigger: with no timed restore, a system reads WOULD NOT RECOVER whatever its backups look like. This test is the backbone of a real ransomware recovery plan.

Pairs well with

An isolated backup is only isolated if its credentials are. The Non-Human Identity & Credential Sprawl Gate ($79) grades service accounts, API keys and tokens on six controls, including vaulted secrets and a working revocation path, and returns GOVERNED, SPRAWLING or UNMANAGED from the weakest control. If your backups live with a cloud vendor, the AI Vendor Reliability & Spend-Justification Scorecard ($79) grades AI and SaaS vendors on uptime, incident load and support. After an incident, the AI Incident Postmortem & Readiness Gate ($79) grades the postmortem and keeps it open while any critical action item, such as a backup fix, is unfinished.