TOOLBOX · DOWNLOAD
Backups thatactuallycome back.
According to the US agency CISA, most ransomware attackers try to find reachable backups and delete or encrypt them. This checklist turns the 3-2-1 rule and its extension with an offline copy and verified recovery into items you can check off. It is based on module CON.3 Data Backup Concept of the BSI IT-Grundschutz Compendium, the BSI Ransomware Measures Catalog, and CISA recommendations.
Free PDF · Checklist
Backup Checklist: 3-2-1-1-0 with an Offline Copy and Tested Recovery
- Topic
- Backup & Emergency
- Format
- PDF, A4
- Length
- 5 pages
- Size
- 77 KB
- Updated
- Oct 22, 2026
- Sources
- 10
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
A data backup checklist, backed by BSI IT-Grundschutz CON.3, the BSI Ransomware Measures Catalog, and CISA.
- Executives and IT managers in small and medium-sized businesses
- Administrators who run or set up backups
- Anyone who has outsourced backups to a service provider and wants to check them
4 SECTIONS
What Is
Inside.
- 01
The Rule: 3-2-1-1-0
What the five digits mean and which body recommends which part.
- 02
Concept and Plans
What is backed up, how often, for how long, and in which order it comes back.
- 03
Store Separately and Securely
Dedicated media, another location, one copy offline, and no overwriting by unauthorized parties.
- 04
Test Recovery: Zero Errors
Regularly, at least once a year, completely, and within a reasonable time.
EXCERPT
The Rule: 3-2-1-1-0
- 3Copies
Three copies of important data: the original and two backups (BSI aid for Standard 200-4, ENISA, CISA).
- 2Storage media
On two different storage media (BSI aid for Standard 200-4, ENISA, CISA).
- 1Copy at another location
One copy at another location, physically separated, ideally in a different fire compartment (BSI CON.3.A12, ENISA, CISA).
- 1Copy offline
One copy offline: disconnected from all other systems after the backup (BSI Ransomware Measures Catalog, CISA #StopRansomware Guide).
- 0Errors during recovery
Zero errors: recovery is tested, and the data comes back intact and on time (BSI CON.3.A15, CISA CPG 2.0).
3-2-1 is recommended by the BSI (aid for BCM Standard 200-4), the EU agency ENISA, and the US agency CISA. The extension to 3-2-1-1-0 is not a standard but a term coined by vendors. However, BSI and CISA explicitly recommend its two additions, an offline copy and verified recovery.
Data mirroring via RAID does not count as a backup (BSI CON.3, description). For entities covered by NIS2, backup management is explicitly one of the risk management measures (§ 32 para. 4 lit. c NISG 2026 (Austrian Network and Information Systems Security Act 2026)).
SOURCES
Supported
by Sources.
- BSI IT-Grundschutz Compendium, module CON.3 Data Backup Concept, 2023 edition (opens in a new tab)Requirements A1, A2, A4, A5, A6, A9, A12 to A15, threats 2.4 and 2.10
- BSI: Ransomware Measures Catalog, version 1.0 of February 23, 2022 (opens in a new tab)Offline copy, separation test, practicing recovery
- BSI: Proposals for Business Continuity Strategies, aid for BSI Standard 200-4 (Community Draft 2.0) (opens in a new tab)Chapter 3.1, 3-2-1 rule
- ENISA: Threat Landscape for Ransomware Attacks (July 2022) (opens in a new tab)Chapter 6.1
- CISA: #StopRansomware Guide (opens in a new tab)Offline and encrypted backups, cloud synchronization, recovery by priority
- CISA: Cross-Sector Cybersecurity Performance Goals 2.0 (opens in a new tab)Offline backups, test at least once a year
- CISA/US-CERT: Data Backup Options (opens in a new tab)3-2-1 rule
- WKO it-safe: Guide to technical and organizational measures under the GDPR (opens in a new tab)Section 3.7, annual recovery test
- NISG 2026, BGBl. I No. 94/2025, § 32 para. 4 lit. c (opens in a new tab)
- Veeam: 3-2-1 Backup Rule (origin of the term 3-2-1-1-0) (opens in a new tab)
This checklist summarizes the requirements and recommendations of the bodies named and does not replace a backup concept. Which frequency, retention, and recovery time suit your systems depends on your business processes.
TOOLBOX
Explore
Further.
GRID.vault
The backup and recovery module of TOMORIS GRID, aligned with your business processes.
Learn More3-2-1 Backup Rule
The rule of thumb for data backup in the glossary, with examples and distinctions.
Learn MoreImmutable Backup
What immutable backups deliver and what matters most.
Learn MoreRPO and RTO
How much data loss is tolerable and how quickly systems must be back.
Learn More
BACKUP & EMERGENCY
More on
This Topic.
- PDF
IT Emergency Manual
Crisis team, contact list, classification as disruption, emergency or crisis, immediate measures and recovery with RTO and RPO: a fillable outline based on BSI Standard 200-4.
View - PDF
Ransomware: First Aid
Isolate without destroying traces, secure evidence, block access, report correctly: what matters in the first hours and what you should avoid, backed by BSI, CISA, and the Austrian Federal Criminal Police Office.
View - PDF
Incident Response Playbook
Who does what when a security incident occurs? Phases, roles, decisions with criteria and a fill-in incident log, based on NIST SP 800-61r3, BSI DER.2.1 and the NISG 2026.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.