Short answer: The 3-2-1 rule says you should keep 3 copies of your data, on 2 different types of media, with at least 1 copy off-site. The 3-2-1-1-0 approach takes this a step further against ransomware: it adds that one copy should be immutable or offline, and that restore tests should produce 0 errors. A backup that has not been tested does not count as a backup.
What exactly does the 3-2-1 rule mean?
| Rule | What it means | What does it protect against? |
|---|---|---|
| 3 copies | Live data + 2 backups | Corruption of a single copy |
| 2 different media | For example, a local NAS + cloud storage | Hardware of the same type failing together |
| 1 off-site copy | Outside the office, in a different location | Fire, flood, theft |
| +1 immutable copy | A backup that cannot be deleted (immutable) or is kept offline | Ransomware and malicious deletion |
| 0 errors | Regular restore testing | The "we thought we had a backup" surprise |
Why does ransomware target backups?
Modern ransomware attacks do not just encrypt files; they also find and delete or encrypt the backups on the network. That is because if you have a sound backup, you will not be forced to pay the ransom. This is why backups need to be somewhere the attacker cannot reach:
- Backup storage should not be accessible with the Windows accounts used day to day; it should use separate credentials and multi-factor authentication.
- At least one copy should be stored in a way that cannot be deleted for a set period (immutable), or be physically disconnected from the network.
- The backup software's management console should not be exposed to the internet.
RPO and RTO: How much data loss and downtime can you tolerate?
Every backup plan comes down to two basic questions:
- RPO (Recovery Point Objective): What is the maximum amount of data loss you can accept? On a system backed up daily, in the worst case one day's worth of data is lost.
- RTO (Recovery Time Objective): How quickly must the system be running again, at the latest? For an accounting server this might be a few hours; for a file archive, a few days.
These two targets are set separately for each system, and backup frequency and technology are chosen to meet them. Backing up everything at the shortest interval is expensive, while backing up non-critical systems less frequently is perfectly adequate.
Which data should SMEs back up?
- Accounting, ERP and CRM databases
- Shared file folders and project archives
- Mailboxes (Microsoft 365 and Google Workspace data should also be backed up separately; a cloud service on its own is not a backup)
- Website files and databases
- Server and firewall configurations
The most common backup mistakes
- Mistaking sync for backup: OneDrive or Google Drive sync also replicates deleted or encrypted files to your other devices.
- Keeping the backup on the same server: If the server goes, the backup goes with it.
- Never trying a restore: The fact that a backup file will not open is discovered in the middle of a crisis.
- Not reading backup reports: A backup job that has been failing for weeks may go unnoticed by everyone.
- Depending on a single person: If only one person knows the restore steps, the process stops when that person is unavailable. The steps should be documented.
Why do backups matter under KVKK?
Backups also contain personal data and require the same care as live data. KVKK (Turkey's Personal Data Protection Law, Law No. 6698), which is broadly similar to the EU GDPR in its general concepts, requires that appropriate technical and administrative measures be taken to keep personal data secure. In practice, this means encrypting backups, limiting access to authorized people and defining retention periods.
Do you know whether your backups would actually restore? We review your current backup setup and report the gaps against the 3-2-1-1-0 approach.
Sources
Frequently Asked Questions
Yes. Services such as Microsoft 365 or Google Drive keep your data accessible, but they do not guarantee that files deleted by mistake or encrypted by ransomware can be recovered over the long term. An independent backup of this data should be taken.
For critical systems, a full restore test at least once every three months is recommended. Random file restore checks should also be carried out at more frequent intervals.
Not on its own. An external drive that stays permanently connected to the computer will also be affected by ransomware. An external drive can only be part of a 3-2-1 setup if it is regularly disconnected and stored in a different location.