Skip to content
ITLAB
ESEN

08 / 12 / 2025 · From the lab

3-2-1 Backup: A Simple Rule Against Ransomware

What the 3-2-1 backup rule is, why it helps against ransomware and how to test restores in your small business in Chile. Ask IT Lab for guidance.

The 3-2-1 backup is an easy-to-remember rule for protecting business information. When ransomware strikes, intact and recoverable copies often make the difference between a manageable interruption and a prolonged crisis.

  • The rule calls for three copies, on two types of storage, one of them off-site.
  • Keep at least one copy disconnected or protected against modification.
  • A backup that has never been tested is not a guarantee.

What the rule says

The US agency CISA promotes this recommendation: three copies of important data, held on two different types of media, with one copy away from the main site. CISA also advises keeping offline backups against ransomware, because many attacks look for and delete copies reachable from the network.

Why it helps against ransomware

If files are encrypted, the organisation can restore them from a clean copy instead of depending on third parties. For that, the copy must be out of the attacker's reach: separate from everyday credentials, with restricted access and, where possible, protection that prevents modification or deletion for a defined period.

The restore test

The most common mistake is not a missing backup but never having tried to recover it. A test restore verifies that data is complete, that keys are known and that recovery time fits the operation. To set those times, see RPO and RTO without jargon.

What to do

  1. Identify the data and systems whose loss would stop operations.
  2. Confirm there are three copies, on two storage types, one off-site.
  3. Keep one copy offline or immutable.
  4. Restrict who can delete or alter backups and protect those accounts with multi-factor authentication.
  5. Schedule periodic test restores and record the result and the time taken.
  6. Review the scheme whenever systems change.

Frequently asked questions

Is syncing files to the cloud the same as backing up? Not necessarily: synchronisation can replicate a deletion or an encryption as well. Independent copies are advisable.

How often should I test restores? At a frequency matching the system's criticality and always after major infrastructure changes.

Does backup also cover email and cloud systems? It depends on the service contracted. Check it explicitly with each provider.

Related reading: Five playbooks before the first incident.

When supporting our clients, we usually find that the backup exists but the restore has rarely been tested.

IT Lab supports Chilean organisations in this. Contact us.

Sources

Do you need someone to take care of your technology?

Tell us what you need to organize, protect or solve. The first conversation has no cost: we assess whether our model fits you and what the next steps would be.

Let's talk about your business