Ransomware Backup Strategy: the 3-2-1 Rule, Immutable Copies and Restores You Have Actually Tested

The most reliable protection against ransomware is being able to recover without paying. A sound ransomware backup strategy is a backup regime that follows the 3-2-1 rule (three copies, two different media, one copy off-site), keeps at least one copy immutable or offline, separates backup credentials from the production environment, and proves recovery through regular, real restore tests.

Preventive controls lower the chance of an attack; the right backups stop an attack from shutting the business down.

Why ransomware goes after your backups first

Early ransomware infected a single computer and encrypted its files. Modern attacks work differently. The attacker gets into the network, spends days or weeks taking over privileged accounts, and locates the backup server and shared storage. Encryption is the last step, typically triggered on a weekend or a public holiday. In many cases the backups are the first thing to be deleted or encrypted, because the attacker wants to close off every route to recovery that does not involve paying.

That is why "we back up every night" is not reassurance on its own. If the backup sits on a network share reached with the same domain account as production, an attacker with admin rights reaches the backup too. Many organisations discover this for the first time when they try to restore.

The second leg of today's attacks is data theft. Before encrypting anything, the attacker copies data out and threatens to publish it unless paid. Backups do not solve that second threat: they keep you running, but they do not stop stolen data being released. A backup plan therefore has to sit alongside access control and monitoring.

The cost of being caught unprepared

Ransomware is not a niche category of breach; it is the main body of it.

According to the Verizon 2026 Data Breach Investigations Report, ransomware was present in 48% of all breaches, up from 44% the year before, yet 69% of ransomware victims did not pay. (Verizon 2026 Data Breach Investigations Report)

Not paying does not mean there is no cost. In Sophos' The State of Ransomware 2026, a survey of 2,158 IT and security leaders in 17 countries, data was encrypted in 56% of attacks and the average recovery cost, excluding any ransom, was $1.7 million. Most of that is downtime, overtime, rebuilding systems and lost orders. The picture is not much better for those who pay: the same Verizon report puts the median ransom paid at $139,875, and payment guarantees neither complete recovery nor deletion of stolen data.

The attackers' motive is plain. The Microsoft Digital Defense Report 2025 says attackers sought to steal data in 80% of the incidents Microsoft's teams investigated, and more than half of attacks with known motives were driven by extortion or ransomware.

The 3-2-1 rule and its modern form: 3-2-1-1-0

The classic 3-2-1 rule is still the foundation; the ransomware era has added two items:

An immutable copy is one that nobody, administrators included, can delete or alter until its retention period expires. Many object storage services and backup products support it, and when configured correctly it is the strongest single layer against ransomware.

Building a ransomware backup strategy, step by step

1. List your critical systems and data. ERP and accounting databases, file servers, email, production recipes, SCADA project files, the website. Give each an owner. If you run production, add PLC programs and operator screens; our article what is SCADA explains which components are critical.
2. Agree RPO and RTO targets with management. RPO (recovery point objective) asks how many hours of data you can afford to re-enter; RTO (recovery time objective) asks how soon the system must be running again. Twenty-four hours may be fine for accounting and far too long for order processing. Backup frequency and technology follow from these answers.
3. Separate backup identities from production. The backup server should not be joined to the company domain, and backup admin accounts need their own passwords and multi-factor authentication. Even a domain administrator should not be able to reach the backups. Prefer phishing-resistant methods for these accounts; we compare the options in multi-factor authentication for business.
4. Define at least one immutable or offline copy, and set its retention longer than an attacker could plausibly go unnoticed.
5. Monitor the backups. Failed jobs, backups that suddenly shrink or grow, and deletion attempts should all raise alerts. A sudden change in backup size can be the first sign of encryption.
6. Put restores on the calendar. Every three months, restore at least one critical system to a clean environment and time it. If the measured time exceeds your RTO, the plan is not good enough. We walk through the test scenario, timing and record template step by step in backup restore testing.
7. Write down the recovery order. Identity infrastructure first, or the ERP? Who decides, and who brings up which system? Keep this on paper and somewhere separate, not on a server you will not be able to reach during an attack.

Common backup mistakes

• Treating a sync folder as a backup. A file encrypted on a laptop is synced to the cloud folder in its encrypted form.
• Backing up files only. Forget databases, virtual machine configurations, licence files and network device settings, and the data comes back but the systems do not run.
• Retention that is too short. If the attacker sat quietly on the network for two weeks, a regime that keeps only seven days of backups leaves no clean copy to go back to.

What needs to sit alongside backups

Backups soften the outcome of an attack; they do not reduce its likelihood. Without the controls below, your backups will be tested more often than you would like:

• Multi-factor authentication on email and remote access; phishing emails are one of ransomware's most common entry points. An email layer such as SmartMail business email, which checks every incoming message for SPF, DKIM and DMARC identity, look-alike domains, display-name impersonation and content, and quarantines anything below the trust threshold with its reasoning, narrows that door; it does not replace MFA or backups.
• Rapid patching of internet-facing VPN, remote desktop and firewall software; prioritisation is covered in our patch management process guide.
• No day-to-day use of admin accounts, least privilege throughout and clear business password security rules.
• Versioning documents instead of overwriting them. In SmartFiles document management, part of the Smart360 suite, uploading a file with the same name stores a new version, earlier versions can be restored and deleted folders come back from the recycle bin. That makes recovering individual files easier; it does not replace an independent, immutable backup. How to set versioning up is covered in document version control.
• Separation of office and production networks; we cover the production side in our article on OT security for SCADA environments.

We have set out all of these controls in order in our SME cyber security checklist.

The first hours of an attack

However good the plan, what happens in the first hours shapes the outcome. Disconnect affected devices from the network but do not switch them off, because memory and logs are valuable for investigation. Disconnect the backup systems and confirm the immutable copy is intact. Assume the attacker may still be inside and change passwords from a clean device. If personal data is affected in Türkiye, the notification clock under KVKK, the Turkish Personal Data Protection Law No. 6698, starts running; we explain the process step by step in our article on data breach notification within 72 hours under KVKK.

Keeping backups on the same network as the file server means a ransomware incident can take both at once. How to rebuild your backup routine when moving the file server to the cloud is covered in replacing an on-premise file server.

How Digital Bridge can help

We approach ransomware resilience where two of our services meet:

• Backup and disaster recovery design: through our cloud migration and infrastructure consultancy, we agree acceptable data loss and downtime for each system with your management, review your current backup regime, build backup and restore scenarios and actually test the restores. In hybrid designs we use measured data to decide which copies stay on-premises and which go to the cloud; the budget lines on the cloud side are covered in our article on cloud migration cost.
• Shrinking the attack surface: through our cyber security consultancy, vulnerability scanning and a written-scope penetration test identify the paths an attacker could use to reach your backup server. Findings are delivered by severity, each with a practical fix; see our penetration testing guide for how that works.
• Personal data: we align retention periods (data retention and disposal policy) and access controls for personal data held in backups with our data protection compliance work.
• Awareness: phishing simulations and an incident reporting procedure increase the chance an attack is spotted early. The yearly programme is described in our security awareness training program guide.

Next step

This month, answer one question: "If our file server or ERP were encrypted tonight, what data could we be working with by tomorrow evening?" Answer it with a restore test, not an estimate. If the result is not reassuring, get in touch; we will review your backup regime with you and send a written proposal with clear stages and cost. Our other articles on prevention and compliance are collected in the Cyber Security & Compliance guide.