Backup 3-2-1: why restore testing matters
Published:
Short answer: a backup is worth only as much as the restore you have tested. The 3-2-1 rule says to keep three copies of your data, on two different types of storage, with one offsite or cold copy.
Why ransomware targets backups
Microsoft's documentation points out that attackers invest heavily in neutralising backup applications and operating-system features such as volume shadow copies. That is why a copy reachable from the same network and the same accounts does not protect you enough.
What 3-2-1 means in practice
| Number | What it means | Example |
|---|---|---|
| 3 | Three copies: the original and two backups | Server, local backup, cloud backup |
| 2 | Two different storage types | NAS disks and cloud storage |
| 1 | One copy offsite or cold | Cloud with deletion protection, or a disconnected medium |
Microsoft 365 does not automatically mean backup
Microsoft keeps its position on shared responsibility for data protection and offers Microsoft 365 Backup as an additional tool. In its FAQ it explains that disaster-recovery copies keep the current state rather than earlier versions, and that file versions do not scale well in a large ransomware attack. If your data sits in SharePoint, OneDrive and Exchange, it is worth deciding explicitly how you would restore it.
How to test recovery
- Choose what to test: a file, a mailbox, a system or a full scenario. Start with the most critical.
- Restore to a separate location, not over production, and check that the data opens and is complete.
- Time it: how long did it take? That is the real recovery time you can promise management.
- Record the result and any problems, and fix them. Repeat at regular intervals and after system changes.
- Keep recovery instructions and contact details outside the network. Microsoft notes that attackers target these documents too.
Frequently asked questions
How often should I test restores?
There is no universal rule. Microsoft recommends exercising the continuity and recovery plan regularly. In practice we suggest testing at least once a year for critical systems and after any major change.
Is OneDrive enough as a backup?
It provides file versions and a recycle bin, which help with individual mistakes. For a mass attack or deliberate deletion, Microsoft explains that you need a separate backup solution that can restore to an earlier state.