Backup or Bust: Picking a Recovery Strategy That Actually Works

Imagine you're staring at a ransomware note on your screen, and your files are gone. You call your IT guy, and he says, "We have backups." But when you try to restore, the backup is encrypted too. That's the nightmare scenario the 3-2-1 rule was supposed to prevent, but it fell short. Let's fix that.

The truth is, most backup strategies are built on hope, not on hard numbers. You set a backup schedule and pray you never need it. But recovery is a science, and it has two numbers that matter: RPO and RTO. RPO is how much data you can afford to lose, measured in time. RTO is how fast you need to be back online. If you don't know these numbers, you're flying blind.

So, let's compare three recovery approaches: the classic 3-2-1 rule, the modern 3-2-1-1-0 rule, and continuous data replication. Each has a different profile, and I'll tell you which one wins and when.

The Contenders: 3-2-1, 3-2-1-1-0, and Replication

The 3-2-1 rule is the old standby: three copies of your data, on two different storage media, with one copy off-site. It's a solid baseline, but it doesn't protect you from ransomware that sits dormant and then wipes your backups. That's why the updated 3-2-1-1-0 rule adds an immutable or air-gapped copy and zero unverified backups (CISA). Immutability means data is locked after creation—no alteration, no deletion (NIST SP 800-209).

Then there's replication, which is often confused with backup. Replication writes the same data to at least two separate locations, either in real time (synchronous) or on a schedule (asynchronous) (NIST SP 800-209). It gives you a near-current copy, but it's not a backup if it's on the same network—an attacker can hit both.

Each approach has its strengths, but they're not interchangeable. You need to match them to your RPO and RTO targets.

RPO and RTO: Why They're the Only Metrics That Matter

RPO is the maximum acceptable data loss in time. If your RPO is 5 minutes, you can't afford to lose more than 5 minutes of data. RTO is the maximum acceptable downtime. NIST SP 800-34 says RTO must be shorter than your Maximum Tolerable Downtime (MTD)—that's the point where your business is irreparably harmed (NIST SP 800-34 Rev. 1).

For mission-critical systems, you might need an RTO under 1 hour and an RPO under 5 minutes (NIST). That's aggressive. The 3-2-1 rule with daily backups gives you an RPO of up to 24 hours—way too much. The 3-2-1-1-0 rule with immutable copies doesn't improve RPO unless you also do frequent snapshots. Replication, especially continuous data protection (CDP), can get you an RPO of seconds, because changed blocks are continuously transmitted to a target (NIST SP 800-209).

But replication has a catch: if the source data is corrupted, the replica is often corrupted too (NIST SP 800-209). So you need point-in-time copies as well. Snapshots are storage-efficient point-in-time copies that only store changed blocks, but they're not a backup if they're on the same array—if the source is unavailable, the snapshots are often unusable (NIST SP 800-209).

Comparing the Three: A Table

What Actually Happens When Ransomware Hits

Ransomware has evolved to target backups directly. NIST SP 800-209 warns that attackers go after not just primary data but also backups and copies, and they may interfere with the backup process to slowly poison future copies (NIST SP 800-209). That's why the 3-2-1 rule fails—it doesn't guarantee an untouchable copy.

CISA's #StopRansomware Guide recommends maintaining offline, encrypted backups and regularly testing them (CISA). And their incident response checklist says to restore from offline, encrypted backups, prioritizing critical services, and being careful not to re-infect clean systems (CISA ransomware response checklist).

Here's a concrete scenario: You run a dental practice with patient records. Your RPO is 5 minutes because you can't lose appointment bookings. Your RTO is 2 hours because you can't keep patients waiting. A 3-2-1 setup with nightly backups would lose a day of data—unacceptable. You need replication, but you also need an immutable snapshot to protect against corruption. So you set up asynchronous replication to a cloud provider, plus hourly immutable snapshots. That gives you an RPO of under an hour and an RTO of maybe 30 minutes.

Testing: The Missing Piece

All this is useless if you never test restores. An untested backup is just an assumption (NIST). CISA says to regularly test backups (CISA). NIST SP 800-209 recommends testing at least monthly for critical data, and doing end-to-end test restores to a sandbox environment for strict RTO requirements (NIST SP 800-209).

Also, keep a recovery catalog that records each copy and the results of anti-malware scans. Periodically scan a subset of past copies with current anti-malware tools to catch poisoned copies (NIST SP 800-209). And review your backup plan at least annually (NIST SP 800-209).

So, what's my verdict? For most businesses, the 3-2-1-1-0 rule is the minimum. It gives you that immutable copy that can survive ransomware. But if you have critical systems, you also need replication to meet tight RPOs. The ideal is a hybrid: replication for speed, immutable backups for safety, and regular testing to make sure both work.

What I'd Actually Do

If you're a small business, start with 3-2-1-1-0. That means three copies, two media, one off-site, one immutable or air-gapped, and zero unverified backups (CISA). For your off-site copy, use a cloud service with versioning and immutability. For your on-site copy, use a NAS with immutable snapshots. And test restores monthly.

If you have mission-critical systems with an RPO under 5 minutes, add replication. But don't rely on it alone—pair it with immutable snapshots. And make sure your replication target is also encrypted and access-restricted, because the same protection must apply to secondary storage (NIST SP 800-209).

Don't forget to encrypt backups and protect encryption keys separately. If you back up encrypted data, keep the keys safe and don't store them with the data (NIST SP 800-209).

Finally, have an incident response plan. If ransomware hits, report it to the FBI IC3 or Secret Service (CISA). And don't pay—restore from your backups.

You don't need the perfect system. You need one that meets your RPO and RTO. So, calculate those numbers, pick a strategy, and test it. Because when the worst happens, you'll thank yourself.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• CISA ransomware response checklist - https://www.cisa.gov/stopransomware/ive-been-hit-ransomware