Configure Backups Using the 3-2-1 Rule
A tested backup is the one control that turns ransomware from a catastrophe into an inconvenience. Follow the 3-2-1 rule and prove your restores work before you need them.
Before you start
- ✓A list of where your critical data lives (files, email, cloud apps)
- ✓A budget for at least one off-site or cloud backup target
Steps
- 1
Inventory your critical data: shared files, email, accounting, line-of-business apps, and any cloud SaaS data not covered by vendor retention.
- 2
Keep three copies of critical data: the original plus two backups.
- 3
Store backups on two different media types, such as local disk and cloud.
- 4
Keep at least one copy offline or off-site where ransomware cannot reach or encrypt it.
- 5
Use immutable or append-only storage for cloud backups so attackers cannot delete or overwrite them.
- 6
Document the restore procedure for each data source, including who is authorized to run it and how long it should take.
- 7
Run a full restore test at least quarterly and record what worked, what failed, and how long it took.