The 3-2-1 rule is no longer enough: why your backups must be immutable
Three copies, two media, one off site: the classic rule protects against failure, not ransomware. What to add in 2026.
5 September 2026 · 1 min read · ALLSAFE SOLUTIONS
The 3-2-1 rule was designed for disks that fail and offices that burn. It is still right. But modern ransomware does not break your disks: it hunts for your backups, encrypts them first, then goes after production. A copy the attacker can reach is not protection.
What changed
Ransomware groups spend several days on average inside a network before encrypting. During that time they map backup servers, harvest credentials and delete restore points. On the day, there is nothing left to restore, and the ransom becomes the only way out.
Immutable, concretely
An immutable backup is a copy that cannot be modified or deleted for a fixed period, even by an administrator, even with the right password. Technically it relies on:
- object storage with locking (S3 Object Lock or equivalent), hosted outside your network;
- credentials separate from your domain, with MFA;
- a retention period longer than an attacker’s typical dwell time, at least 30 days.
The rule becomes 3-2-1-1-0
Three copies, two media, one off site, one immutable, and zero errors on the restore test. That last point is the one everyone forgets: a full restore must be tested at least once a quarter, stopwatch in hand.
What about the cloud?
Microsoft 365 and Google Workspace do not back up your data in the true sense. The recycle bin and default retention cover neither malicious deletion nor encryption through a compromised account. Third-party backup of mailboxes, SharePoint and Drive is essential.
This setup is included in our business cybersecurity service, with a documented quarterly restore test.
Let’s talk about your project.
Free initial audit, reply within one business day.