Your Local Backup Is Not a Backup: A Field Report on the 3-2-1-1-0 Rule

Your local backup is not a backup. I mean it. If your only copy of critical data lives on a USB drive in the same room as your server, you don't have a backup strategy—you have a false sense of security. The 3-2-1 rule, coined by photographer Peter Krogh, calls for 3 copies of data, on 2 different storage media, with 1 copy off-site (CISA). But the modern threat landscape demands more. Enter the 3-2-1-1-0 rule: add 1 immutable or air-gapped copy and 0 unverified backups (CISA). That last zero is the killer. An untested backup is just an assumption.

Imagine You're a Sysadmin at a 50-Person Law Firm

You've got a file server, a NAS, and a cloud sync folder. Your boss asks: “Are we protected?” You say yes. Then ransomware hits. The attackers encrypt your file server and your NAS because they're on the same network. Your cloud sync? It syncs the encrypted files right over your clean copies. Game over. This is not hypothetical—NIST SP 800-209 warns that attackers target backups and copies, and may interfere with the backup process to gradually poison future copies.

Define RPO and RTO Before You Buy Anything

You can't pick a backup tool until you know your Recovery Point Objective (RPO) and Recovery Time Objective (RTO). RPO is the maximum acceptable data loss measured in time—the latest point to which data can be restored (NIST). RTO is the maximum acceptable downtime before systems must be restored (NIST). For a law firm, losing billable time records from the last 24 hours might be tolerable; losing client case files from the last week is not. NIST SP 800-34 notes that RPO is not part of Maximum Tolerable Downtime (MTD); it's a factor of how much data loss the mission can tolerate. RTO must normally be shorter than MTD. So if your firm can't tolerate more than 8 hours of downtime, your RTO must be under 8 hours.

Local Backup Options: Snapshots vs. Full vs. Incremental

Local backup isn't one thing. It's a spectrum. A snapshot is a point-in-time copy that often uses pointers, not a full physical copy (Backup terminology). That's fast and cheap, but NIST SP 800-209 defines a snapshot as storing only changed portions, and if the source data is unavailable, snapshots often aren't usable either. Broadcom/VMware is blunt: VMware snapshots are not backups. A snapshot file is only a change log; if base disks are deleted, snapshot files alone can't restore a VM. Worse, a single VMware snapshot shouldn't be kept more than 72 hours because the file grows and can fill your storage. Full backups copy every file—most complete, but slow and storage-heavy. Incremental backups copy only files changed since the last backup of any type, so restoration requires the last full plus every incremental. Differential backups copy all data altered since the last full, so you need only the last full plus the most recent differential. For a small firm, a weekly full plus daily differentials is a sane local starting point. But local alone won't cut it.

The 3-2-1-1-0 Rule in Practice

Let's apply it. You need 3 copies: the primary data, a local backup on a different medium (say, a NAS or tape), and one off-site copy. That's 3-2-1. Then add 1 immutable or air-gapped copy. NIST SP 800-209 defines immutability as the ability to lock data after creation, preventing alteration or deletion. Tape is a natural air gap. The LTO Program states that LTO tape provides an inherent air gap solution, and while disk offers faster recovery, it's not offline and not completely secured from ransomware. LTO-9 offers up to 45 TB compressed (18 TB native) and hardware-based encryption, WORM, and LTFS. That WORM functionality is immutability in hardware. Finally, 0 unverified backups. You must test restores. NIST SP 800-209 recommends testing backups at least monthly for critical data, and for strict restoration speed requirements, perform an end-to-end test restore to a sandbox. CISA advises maintaining offline, encrypted backups and regularly testing them.

Comparison: Local Backup Options for a Small Firm

Don't Forget the 0: Test Your Restores

An untested backup is an assumption (NIST). NIST SP 800-53 control CP-9(1) requires testing backup information at an organization-defined frequency to verify media reliability and integrity. For a small firm, that could mean a quarterly restore of a random file and an annual full-system restore test to a sandbox. Also, keep an up-to-date recovery catalog that records each copy and anti-malware scan results, and periodically scan past copies with current tools to catch poisoned backups (NIST SP 800-209). This is how you get to 0 unverified backups.

Quick tip: Never store your encryption keys with your backups. NIST SP 800-209 says data and keys should not be kept together.

The Bottom Line

Local backup is necessary but not sufficient. You need a layered strategy: fast local snapshots for quick recovery, a local NAS or tape for bulk data, and an immutable, air-gapped copy off-site. Test restores monthly for critical data, and annually for the whole system. Define your RPO and RTO before you buy a single drive. And remember: if you haven't tested it, you don't have a backup. You have a hope.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST - https://csrc.nist.gov/glossary
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• Broadcom KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• LTO Program - https://www.lto.org/newsbytes-september-2022/