A backup that does not come back in an emergency is not a backup. With ransomware, that emergency is no accident but part of the attack. According to the #StopRansomware Guide from the US agency CISA, ransomware actors try to find accessible backups and delete or encrypt them so that recovery without paying a ransom becomes impossible. They specifically search for credentials for backup solutions and exploit publicly known vulnerabilities in unpatched backup software.
Resilience therefore means two things: backing up data so that an attacker with administrator rights cannot reach it. And regularly proving that it comes back completely and on time.
The 3-2-1-1-0 rule
The 3-2-1 backup rule is recommended by the German BSI, the EU agency ENISA, and CISA. The extension to 3-2-1-1-0 is not a standard but a term coined by vendors. Its two additions, however, match recommendations from BSI and CISA:
- 3 copies of important data: the original and two backups.
- 2 different storage media, so that a single failure or attack does not hit all copies at once.
- 1 copy at another location, physically separated, ideally in a different fire compartment (BSI CON.3.A12).
- 1 copy offline: disconnected from the other systems after the backup, so that it can be neither deleted nor encrypted from the network.
- 0 errors on restore: The restore is tested, and the data comes back intact and within a reasonable time (BSI CON.3.A15).
BSI and CISA clear up two misconceptions: RAID mirroring is not a backup (BSI CON.3). And automatic synchronization to the cloud is not enough on its own, because encrypted files are synchronized too and can overwrite intact versions (CISA).
Protect the backup environment itself
Because attackers deliberately look for backups, backups belong among the best-protected systems in the company:
- Separate accounts: Do not manage backup servers and storage with the same domain administrator accounts as the rest of IT. The BSI Ransomware Measures Catalog recommends a test: a domain administrator tries to access the separated copies. This must fail.
- Additional confirmation: Microsoft recommends tying any change to or deletion of online backups to an additional step such as multi-factor authentication or a security PIN.
- Immutable storage: Storage based on the WORM principle prevents deletion and modification within a defined period (Immutable Backup). CISA advises care here: not every solution meets all regulatory requirements, and misconfigurations can cause high costs.
- Up-to-date software: Backup software is a known target and belongs at the very top of patch management.
- Encryption: Store backups encrypted and keep the keys separately, so that they are also available in an emergency (BSI CON.3.A13).
- Monitor warning signs: According to CISA, deleting shadow copies and backup catalogs, for example with
vssadminorwbadmin, is a common ransomware technique; MITRE ATT&CK lists it as T1490, Inhibit System Recovery. Such calls belong in your monitoring.
Plan the recovery
In an emergency, the backup list becomes the recovery list. Define the order in advance, based on your business processes. Drawing on its experience, Microsoft gives this ranking: first identity systems such as Active Directory and Microsoft Entra Connect, without which nobody can sign in, then systems on which life and limb depend, financial systems, the systems for your products and services, and a minimum set of security systems.
For every system, two values belong in the plan (RPO and RTO):
- RPO (Recovery Point Objective): the maximum tolerable data loss. This determines how often you back up.
- RTO (Recovery Time Objective): the maximum time the system may be down. This determines how fast the recovery must be technically.
Keep recovery instructions, network diagrams, and contact lists available outside IT as well, for example on paper. The BSI explicitly names ransomware as a reason for this, and Microsoft recommends running exercises on the assumption that email and chat are down. Incident response describes how to handle the incident itself.
Testing: only a verified restore counts
The zero in 3-2-1-1-0 is the decisive part. A successful backup run only proves that something was written, not that it comes back.
- Test regularly: BSI CON.3.A15 requires regular tests of whether backed-up data can be restored intact and within a reasonable time. In its Cybersecurity Performance Goals, CISA specifies at least one test per year; the NIST Cybersecurity Framework 2.0 requires that backups are created, protected, maintained, and tested (PR.DS-11).
- Practice whole systems, not just files: The BSI Ransomware Measures Catalog requires regular practice in restoring data and systems. Microsoft also recommends testing a rebuild from scratch for the case that all systems have failed.
- Check for cleanliness: Before restoring, check whether the backup is intact and free of malware (NIST CSF 2.0, RC.RP-03; BSI Ransomware Measures Catalog). According to the BSI, attackers sometimes move through the network for several weeks after the initial infection and may therefore already be in the backups.
- Measure and document the duration: Every test records date, scope, duration, and result. The goal is only met when the measured duration fits the RTO. Errors are fixed and tested again.
For essential and important entities under the NISG 2026 (Austrian Network and Information Systems Security Act 2026), backup management and recovery after an emergency are explicitly part of the risk management measures (§ 32 para. 4 lit. c). The article NIS2 in Austria shows which other obligations apply.
Checklist
- RPO, RTO, and the recovery order are defined for every system.
- There are three copies on two media, one of them at another location.
- At least one copy is offline, and the test with a domain administrator account demonstrably fails.
- Backup accounts are separate and protected with multi-factor authentication, and the backup software is up to date.
- Backups are encrypted, and the keys are stored separately.
- Recovery plans and contact lists are also available offline.
- Restore tests run regularly, at least once a year, with documented duration.
The detailed checklist with all references is available as a free PDF: 3-2-1-1-0 Backup Checklist.
If you do not want to run backup and recovery yourself: with GRID.vault, TOMORIS aligns backup scope, retention, and recovery objectives with your business processes, monitors the backup runs, and tests restores as agreed.
Frequently asked questions
Isn't data in Microsoft 365 backed up anyway?
Microsoft 365 includes versioning and a recycle bin for OneDrive and SharePoint, which let you roll files back to an earlier state. This helps with individual encrypted or deleted files. It is not a separate copy in the sense of 3-2-1-1-0. For cloud backups, CISA recommends also considering the case that all accounts with the same provider are affected.
How often should we test recovery?
Regularly and after every major change to systems or backups. CISA names one test per year as the minimum. For systems with a short RTO, testing more often makes sense, because only a test shows whether the time is really sufficient.
What is the first step in an emergency?
Isolate the affected systems and start the emergency plan; do not restore right away. Only after the cause has been found and eliminated do you restore from verified, clean backups, in the defined order. In parallel, check your reporting obligations, for example under the NISG 2026 or Art. 33 GDPR.
Sources
- BSI IT-Grundschutz Compendium, module CON.3 Data Backup Concept, 2023 edition: description and A6, A12, A13, and A15
- BSI: Ransomware Measures Catalog
- CISA: #StopRansomware Guide, October 2023 version
- CISA: Cross-Sector Cybersecurity Performance Goals 2.0, goal 3.O
- NIST Cybersecurity Framework 2.0 (NIST CSWP 29): PR.DS-11 and RC.RP-03
- Microsoft Learn: Backup and restore plan to protect against ransomware
- MITRE ATT&CK: T1490 Inhibit System Recovery
- ENISA: Threat Landscape for Ransomware Attacks, July 2022, chapter 6.1
- NISG 2026, BGBl. I No. 94/2025: § 32 para. 4 lit. c
- Veeam: The 3-2-1 Backup Rule, origin of the term 3-2-1-1-0