Your Backup Is Already Gone: A Field Guide to Restoring Before It's Too Late

The Backup Myth That Will Cost You Everything

Everyone thinks they have a backup plan. But what most people call a backup is really just a copy of their data sitting on the same server, or worse, on a drive that's been quietly failing for months. The 3-2-1 rule—three copies, two different media, one off-site—has been the gold standard for years (CISA). Yet, when I ask clients if they've ever actually restored from that backup, the silence is deafening. The truth is, an untested backup is just a wish. You don't have a backup until you've proven you can restore from it.

This isn't theoretical. I've seen the aftermath of a ransomware attack where the 'backup' was a snapshot on the same storage array. It was encrypted right along with the production data. The 3-2-1-1-0 rule adds an immutable or air-gapped copy and zero unverified backups—that's the difference between a minor inconvenience and a business-ending event (CISA). Let me walk you through a realistic scenario to show you what actually matters.

Meet Your Worst Nightmare: A Ransomware Attack on a Small Business

Imagine you're the IT manager for a mid-sized accounting firm. You have 50 employees, a file server with years of financial records, and a database that tracks every client transaction. You've been meaning to update your backup strategy, but you've been busy. Your current setup: a full backup every Sunday, incremental backups nightly, and a differential backup on Wednesdays. You've got a NAS in the server room and a cloud backup service that runs after hours.

One Monday morning, you walk in to find a ransomware note on the receptionist's screen. The attackers have encrypted your file server, the database, and—you discover with horror—the NAS in the server room. They were on the network for weeks, and when they hit, they didn't just target production data; they went after your backup appliance too (NIST SP 800-209). Your cloud backup is your only hope. But when you try to restore, you find that the cloud service has been backing up corrupted files for the last month because the ransomware was quietly encrypting files and the backup software was dutifully copying them.

This is where the 3-2-1-1-0 rule becomes your lifeline. The immutable copy—one that can't be altered or deleted—would have been your saving grace. NIST SP 800-209 defines immutability as the ability to lock data after creation, preventing alteration or deletion. Without it, your backups are just more victims.

RPO and RTO: The Numbers That Define Your Survival

In this scenario, your Recovery Point Objective (RPO) is the maximum data loss you can tolerate. NIST defines RPO as the point in time to which data must be recovered. If your business can't lose more than five minutes of client transactions, then your snapshot interval must be five minutes or less (NIST SP 800-209). But you've been doing daily backups, so you'll lose up to 24 hours of work. Can you afford that? Probably not.

Your Recovery Time Objective (RTO) is how long you can be down. NIST SP 800-34 defines RTO as the maximum time a system can be unavailable before unacceptable impact. For a mission-critical system, you might have an RTO under an hour and an RPO under five minutes (NIST). But your restore from cloud is going to take hours—maybe days—because you've never tested it. The cloud provider's restore speed isn't magic; it depends on your data volume and their infrastructure.

Here's the kicker: NIST SP 800-34 says that COOP functions must be sustained within 12 hours, but that's for federal agencies. For your firm, the board might expect you to be back online within 4 hours. Your RTO must be shorter than your Maximum Tolerable Downtime (MTD), but you don't even know what your MTD is. You're flying blind.

How to Actually Recover: A Step-by-Step Field Guide

So what do you do? First, don't panic. Follow the CISA ransomware response checklist: report the incident to law enforcement via the FBI IC3, and take a snapshot of your cloud volumes for forensic review (CISA). But your immediate priority is restoring service.

Here's the step-by-step I'd recommend:

• Identify your critical systems and prioritize them based on your business impact analysis.
• Restore from your immutable backup first—if you have one. This is where the 3-2-1-1-0 rule saves you. If not, use the oldest clean backup you can find.
• Scan every restored file with current anti-malware tools before putting it back into production (NIST SP 800-209).
• Test the restore in a sandbox environment before going live, especially if you have strict RTO requirements (NIST SP 800-209).

But here's the thing: you should have done this months ago. NIST recommends testing backups at least monthly for critical data, and doing an end-to-end test restore to a sandbox for applications with strict speed requirements (NIST SP 800-209). That's not a suggestion; it's a survival tactic.

Quick tip: If you're using snapshots, remember that they are not a backup. NIST SP 800-209 warns that if the source data is unavailable, snapshots often aren't usable either. They're a convenience, not a recovery solution.

What I'd Actually Do

Here's my blunt advice: stop treating backups as a chore and start treating them as a lifeline. Adopt the 3-2-1-1-0 rule today. That means three copies, two different media, one off-site, one immutable or air-gapped, and zero unverified backups (CISA). Yes, it costs more, but the cost of not having it is your business.

For your RPO and RTO, sit down with your stakeholders and set real numbers. Don't guess. If you can't lose more than five minutes of data, configure your snapshots to run every five minutes (NIST SP 800-209). If you need to be back online in under an hour, you need a tested recovery plan that can do that. And for heaven's sake, test your backups monthly. Set a calendar reminder. Make it a ritual.

If you're already in the middle of an incident, don't make it worse by re-infecting clean systems. Restore from offline, encrypted backups, and prioritize critical services (CISA). And after it's over, review your backup plan annually (NIST SP 800-209). Because the next attack is coming, and this time, you'll be ready.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST - https://csrc.nist.gov/glossary
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• CISA Ransomware Response Checklist - https://www.cisa.gov/stopransomware/ive-been-hit-ransomware