Your Backup Software Is Lying to You: RPO and RTO Are the Only Truth

The Misconception: Backup Software Success Means Recovery

You think your backup software is protecting you because it says "success" every night. That's a lie. Backup software that reports a successful job is just telling you it copied bytes from point A to point B. It says nothing about whether you can restore that data when ransomware hits or a server crashes. The only truth is in your recovery point objective (RPO) and recovery time objective (RTO). If your backups don't meet those, your software is just generating false confidence.

RPO and RTO: The Metrics That Matter, Not the Features

RPO is the maximum acceptable data loss measured in time — the latest point to which data can be restored (NIST). RTO is the maximum acceptable downtime before systems must be back online (NIST). These two numbers define your backup strategy. Everything else — deduplication, compression, fancy dashboards — is noise. Your backup software must be configured to meet these objectives. For example, if your business can't lose more than five minutes of committed data, your snapshot interval must be five minutes or less (NIST SP 800-209). If your RTO is under an hour, your restore process must be tested to hit that. No software feature can excuse missing your RPO or RTO.

Why the 3-2-1 Rule Isn't Enough Anymore

The classic 3-2-1 rule — three copies, two different media, one off-site — is a good baseline, but it's outdated for today's ransomware threats (CISA). Attackers now target your backups directly. They don't just encrypt your primary data; they poison your backup copies so that when you restore, you're restoring corrupted data (NIST SP 800-209). That's why CISA promotes the modernized 3-2-1-1-0 rule: add one immutable or air-gapped copy, and zero unverified backups (CISA). Immutability means data is locked after creation, preventing alteration or deletion (NIST SP 800-209). If your backup software doesn't support immutable copies, you're leaving your backups vulnerable to the very attack they're supposed to protect against.

The Counter-Argument: "But My Backups Are Off-Site and Replicated"

Some argue that off-site replication is enough. They point to cloud backups or synchronous replication as a safety net. But replication is not a backup. NIST SP 800-209 defines replication as writing the same data to at least two locations, but it's not a point-in-time copy. If a ransomware attack encrypts your primary storage and your replication target simultaneously — and attackers often wait for that — you've lost everything. Even snapshots are not immune: a snapshot is a storage-efficient point-in-time copy, but if the source data is unavailable, the snapshots often won't be usable either (NIST SP 800-209). The only way to protect against this is to have an immutable or air-gapped copy that is physically or logically isolated from your production network. That's non-negotiable.

Testing: The Only Way to Make Your Backups Honest

Here's the hard truth: an untested backup is an assumption (NIST). CISA advises maintaining offline, encrypted backups and regularly testing them (CISA). NIST SP 800-209 recommends testing backups at least monthly for critical data, and for applications with strict restoration speed requirements, performing an end-to-end test restore to a sandbox recovery environment. Also, keep a recovery catalog that records each copy and the results of anti-malware scans, and periodically scan past copies with current anti-malware tools to identify poisoned copies (NIST SP 800-209). This is not optional. If you don't test, you don't know. And if you don't know, your backup software is lying to you.

Takeaway

Stop trusting your backup software's success indicators. Define your RPO and RTO, configure your backups to meet them, adopt the 3-2-1-1-0 rule with immutable copies, and test your restores monthly — at minimum. Only then will your backups be honest. Otherwise, you're just paying for a false sense of security.

Sources

• CISA (data backup guidance) - https://www.cisa.gov/stopransomware
• NIST (contingency planning) - https://csrc.nist.gov/glossary
• NIST SP 800-209 (Storage Infrastructure Security) - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 (Contingency Planning Guide) - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf