Why Your Backups Are Lying to You: The 3-2-1-1-0 Truth

Myth: “We have backups, so we’re safe.”

That’s a dangerous assumption. If you haven’t tested a restore recently, your backups are just a pile of bits that may or may not work when you need them. As working practitioners, we’ve seen too many organizations learn this the hard way. The truth is, an untested backup is an assumption, not a guarantee. (NIST)

How much data can you afford to lose?

That’s your Recovery Point Objective (RPO). It’s the maximum acceptable data loss measured in time—the latest point to which data can be restored. (NIST) For mission-critical systems, we often set RPOs under five minutes. That means you need continuous or near-continuous backups. For less critical stuff, maybe an hour is fine. But if you don’t define an RPO, you’re just guessing, and guessing is how you end up explaining to your boss why you lost a day’s worth of sales orders.

How fast do you need to be back online?

That’s your Recovery Time Objective (RTO). It’s the maximum acceptable downtime before systems and business functions must be restored. (NIST) Think of it as the clock ticking from the moment disaster strikes. If your RTO is two hours, your recovery process needs to get you up and running within that window. Remember, your RTO must be shorter than your Maximum Tolerable Downtime (MTD)—the absolute limit beyond which the business is critically harmed. (NIST SP 800-34)

“We use snapshots, so we don’t need backups.”

Wrong. Snapshots are point-in-time copies that often use pointers rather than full physical copies, so they’re fast and cheap. But they’re not a substitute for backups. If the source data is unavailable, your snapshots often are too—they live on the same storage, and if that storage gets hit by ransomware or fails, your snapshots go down with it. (NIST SP 800-209) That’s why we treat snapshots as a convenience, not a safety net.

“Our replication is enough.”

Replication—synchronous or asynchronous—writes the same data to at least two separate locations. That’s great for high availability, but it’s not a backup. If you accidentally delete a file or a ransomware attack encrypts everything, replication will happily copy that deletion or encryption to your second site. (NIST SP 800-209) You need backups that are immutable or air-gapped, so they can’t be altered or deleted. That’s the “1-1” in the modernized rule.

What is the 3-2-1-1-0 rule, and why should you care?

The classic 3-2-1 rule—3 copies of your data, on 2 different media, with 1 copy off-site—has been around for years. But CISA’s updated guidance adds two more “1s” and a “0”: 1 immutable or air-gapped copy, and 0 unverified backups. (CISA) The immutable copy means it’s locked so even a ransomware attacker can’t encrypt or delete it. The zero means you actually test your backups regularly—no excuses. This rule isn’t just a nice-to-have; it’s the baseline for surviving ransomware.

“Our backups are encrypted, so we’re fine.”

Encryption is important, but it’s not enough. NIST SP 800-209 warns that attackers don’t just target your primary data—they go after your backups too. They might interfere with the backup process itself, gradually poisoning future copies. That’s why you need to protect the encryption keys separately from the data, and why you should periodically scan your backups for malware. (NIST SP 800-209) Encryption doesn’t help if your backup is corrupted or infected.

“We test our backups once a year.”

That’s better than never, but it’s not enough. NIST recommends testing backups at least monthly for critical data. (NIST SP 800-209) And if you have strict restoration speed requirements, do an end-to-end test restore to a sandbox environment. (NIST SP 800-209) We’ve seen too many organizations skip this and then discover, during an actual incident, that their backup files are corrupt or their restore process takes twice as long as planned. Testing isn’t a chore; it’s the only way to know your backups work.

The takeaway

Your backup strategy should be built on the 3-2-1-1-0 rule: three copies, two media, one off-site, one immutable/air-gapped, and zero unverified. That means defining your RPO and RTO, using a mix of full, incremental, and differential backups, and testing restores monthly. Don’t rely on snapshots or replication alone—they’re not backups. And remember, ransomware is constantly evolving, but a solid backup strategy is your last line of defense. Stop assuming, start testing.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf