Backup Checklist: 3-2-1-1-0 with an Offline Copy and Tested Recovery

• 3Copies

  Three copies of important data: the original and two backups (BSI aid for Standard 200-4, ENISA, CISA).

• 2Storage media

  On two different storage media (BSI aid for Standard 200-4, ENISA, CISA).

• 1Copy at another location

  One copy at another location, physically separated, ideally in a different fire compartment (BSI CON.3.A12, ENISA, CISA).

• 1Copy offline

  One copy offline: disconnected from all other systems after the backup (BSI Ransomware Measures Catalog, CISA #StopRansomware Guide).

• 0Errors during recovery

  Zero errors: recovery is tested, and the data comes back intact and on time (BSI CON.3.A15, CISA CPG 2.0).

3-2-1 is recommended by the BSI (aid for BCM Standard 200-4), the EU agency ENISA, and the US agency CISA. The extension to 3-2-1-1-0 is not a standard but a term coined by vendors. However, BSI and CISA explicitly recommend its two additions, an offline copy and verified recovery.

Data mirroring via RAID does not count as a backup (BSI CON.3, description). For entities covered by NIS2, backup management is explicitly one of the risk management measures (§ 32 para. 4 lit. c NISG 2026 (Austrian Network and Information Systems Security Act 2026)).

• The framework conditions are recorded for every system: data to be backed up, storage and change volume, availability, confidentiality, legal requirements, deletion rules, and responsibilities (CON.3.A1).
• The type, frequency, and timing of backups are defined, as are storage media, transport, and retention (CON.3.A2).
• There is a backup plan for each system or group of systems: what is backed up, recovery order, procedure, retention period, protection against access and overwriting, and the hardware and software used (CON.3.A4).
• For every system, the maximum tolerable data loss is defined (Recovery Point Objective, CON.3.A6).
• The recovery plans are available even if the backup system itself fails, for example also on paper (CON.3.A6; threat 2.4 cites ransomware as the reason).
• All employees know the backup rules and their own tasks in them (CON.3.A5).
• Online storage is governed by contract: storage location, availability, sign-in, and encryption of stored and transmitted data (CON.3.A9).

• Backups are always stored on dedicated storage media, not only on the system being backed up (CON.3.A2).
• The media are stored physically separated from the backed-up systems, ideally in a different fire compartment (CON.3.A12).
• At least one copy is offline and disconnected from all other systems after the backup (BSI Ransomware Measures Catalog; CON.3.A2 for media requiring special protection).
• Separation test: a domain administrator tries to access the separated copies as a test. This must fail (BSI Ransomware Measures Catalog).
• Backups cannot be overwritten, either intentionally or by accident; only authorized backup and administration processes have write access (CON.3.A14).
• Backups are encrypted, the keys are backed up separately, and encrypted data can still be restored even after a long time (CON.3.A13, for elevated protection needs).

Automatic synchronization to the cloud is not an adequate backup on its own: if an attacker encrypts the local files, the encrypted versions are synchronized as well (CISA #StopRansomware Guide).

• Regular tests check whether backed-up data can be restored intact and within a reasonable time (CON.3.A15).
• Recovery is tested at least once a year (CISA CPG 2.0; WKO guide on technical and organizational measures).
• The recovery of data and entire systems is practiced, not just the backup (BSI Ransomware Measures Catalog).
• The recovery order follows the importance of the services (CON.3.A4; CISA #StopRansomware Guide).
• Regular checks confirm that the backup concept is implemented as described (CON.3.A6).
• The result and duration of every test are documented; errors are fixed and tested again.

The last item is a TOMORIS recommendation: only a documented, successful test shows that the zero in 3-2-1-1-0 has been achieved.