Backups: the 3-2-1 rule, and the “-1-0” that changes everything.

The 3-2-1 rule fits in one sentence: three copies of your data, on two different media, one of them off site. It dates from a time when the main risk was hardware failure. Today the main risk is an attacker encrypting your data and your backups at the same time. Hence the full version: 3-2-1-1-0.

The “-1”: an offline or immutable copy

A backup writable from your network is not a backup, it is a target. You need at least one copy nobody can modify: a disconnected tape, object storage with locking (object lock), or an isolated backup repository with separate credentials. The account writing backups must never be a domain administrator.

The “0”: zero errors on restore

A backup only exists once it has been restored. We require a full, timed restore test every quarter on a representative system. The measured time becomes your real RTO, not the one in the contract.

Implementation checklist

1. Inventory what must be backed up: servers, workstations, databases, Microsoft 365 (mailboxes, SharePoint, OneDrive, Teams), network configurations.
2. Set an RPO (acceptable data loss) and an RTO (acceptable downtime) per system. These two numbers dictate frequency and technology.
3. Separate credentials: dedicated account, MFA, no rights on production.
4. Enable immutability or physical disconnection on at least one copy.
5. Encrypt off-site copies and keep the keys somewhere other than the system being backed up.
6. Monitor the jobs: a silent failure for three weeks is the most common scenario.
7. Test restores every quarter and record the result.
8. Write the recovery plan: who does what, in which order, with which access, if the domain is unavailable.

The Microsoft 365 case

Microsoft 365’s native retention protects against a recent deletion, not against corruption, a compromised account or a restore several months back. A third-party backup of the suite remains necessary for most companies, and it is what a NIS2 auditor will ask you to demonstrate.