Having a 3-2-1 backup means maintaining three copies of your data, using two different types of media, with at least one copy stored off-site or disconnected from the network. If ransomware encrypts both the files and the backup connected to the same network, a backup copy stored separately will allow for restoration without paying the ransom. Without a recoverable backup, the response requires evaluating alternative recovery sources and specialized assistance; paying the ransom does not guarantee data recovery.
Published June 25, 2026. Editorial review: September 29, 2026. Prices are net references; confirm the scope in a proposal.
The day a ransomware infiltrates a company, they become aware of it through a screen: the files have a new extension, and a message demands a payment in cryptocurrency to recover them. The first thing any technician checks is the backup. And that’s where it’s discovered whether the company actually had a real backup, or just a copy that was living on the same network, encrypted along with everything else.
What happens when a ransomware attack occurs?
A ransomware doesn’t just target the shared folder; it scans connected drives, network drives, and, if valid credentials are found, entire servers. A prepared response combines prevention, detection, containment, and recovery. Isolated backups and test restores are an essential component: they allow you to assess which data can be recovered without relying on the attacker.
The 3-2-1 rule, explained in a straightforward way, without technical jargon.
The rule is simple to say and easy to ignore.
- Three copies For each important piece of data: the original plus two backups.
- Two separate entities.For example, a local drive and a cloud service. Diversification reduces common failures; furthermore, the copies should be on independent devices or locations. Using the same type of drives does not, by itself, mean that all of them will fail at the same time.
- A copy outside of the site.“In a separate location. To resist ransomware, it’s also necessary to have isolation, access controls, or immutability—being off-site alone isn’t enough.”
The point that almost no one follows is the third one. It’s common to find an external hard drive permanently connected to the same server – technically, this constitutes a second copy – but it’s not considered “off the network.” If the server gets infected, the external hard drive can also become vulnerable.
The most frequently repeated error
In multiple reviews, we consistently found the same pattern: automatic backup, which has been configured for years, pointing to a shared folder within the same Windows domain as the rest of the machines. It works perfectly for recovering a file accidentally deleted. However, it may fail against ransomware if the attacker manages to access it with sufficient permissions.
How much does it cost to do it well?
| Component | What does it solve? | Reference cost |
|---|---|---|
| Local backup (NAS or hard drive) | Quick recovery of deleted or damaged files | Equipment cost, one-time cost |
| Cloud backup, isolated. | An external copy with access controls, isolation, or immutability. | Starting from $25,000 per month for 250 GB. |
| Quarter restoration test | Confirm that the support is actually effective, not just that it exists. | Included in the managed cybersecurity service. |
| Endpoint Protection (EDR) | Detecting suspicious activity and helping to contain it. | Starting from $4,500 per team per month. |
None of these four layers replaces the others. The EDR reduces the likelihood of an attack; the 3-2-1 backup improves the chances of recovering information; integrity and recovery time must be verified.
How does one truly test it?
Testing a backup is not about verifying that the file… .bak There is a backup, and it weighs what it should. It involves restoring it in a separate environment and verifying that it opens, that the data is complete, and that the entire process – from the decision to restore to the system returning to normal operation – takes a timeframe that the business can tolerate. That quarterly test is what distinguishes a genuine backup from a folder with good intentions.
Two questions differentiate a genuine test from a preparatory test. The first: Was the restoration performed on a different system than the one that originally created the backup, or on the same infected server? If it was performed on the same system, that doesn’t prove anything against ransomware. The second: Did anyone measure how long the entire process took, from the moment the decision to restore was made, to when the system was fully operational again? The actual time taken, not simply the fact that “a backup exists,” is the metric that needs to be known before an incident occurs, not during it.
What isn't counted as the third copy?
It’s worthwhile to list the most common errors, because they appear to be a 3-2-1 backup, but they aren’t: an external hard drive that remains permanently connected to a server (which is encrypted in the same way), a folder synchronized with a cloud service but without file versioning (ransomware also synchronizes encrypted files, overwriting the good ones), or a backup that is created but never checked to ensure it was successful – many run with silent errors for months. A third, genuine backup is typically disconnected from the network by default, or it versions files in a way that a previous version, even before the infection, remains available and cannot be deleted using the same compromised credentials.
What to do if it’s already happened.
Disconnect the affected device from the network immediately, without shutting it down (to preserve evidence), and do not pay the ransom as the first step: in many cases, paying the ransom does not guarantee the full recovery of your data. With a 3-2-1 backup strategy in place, restoring from the isolated copy is usually faster and cheaper than any negotiation. If your company doesn’t have a third backup today, the most sensible first step is a review… cybersecurity Before it’s needed, not afterward.
Technical reference
The CISA Ransomware Prevention Guide It is recommended to maintain encrypted backups that are offline, and to test their availability and integrity. Recovery also depends on the scope of the incident and the state of the systems.
Frequently Asked Questions
What does "3-2-1" exactly mean?
Three copies of the data, using two different media types (for example, a local drive and the cloud), with at least one copy stored offsite or disconnected from the primary network.
Why doesn't a backup within the same network suffice?
Because a ransomware that enters a network also encrypts backups connected to it. If the only copy of the data is on the same server or shared folder, it will be lost along with everything else.
How often should a backup be tested?
With a genuine restoration process, not just verifying that the file exists, at least once per quarter. A backup that has never been restored is an assumption, not a backup.
How much does a cloud backup solution cost for a small business?
Starting from $25,000 per month for 250 GB within Ditap Tecnología’s cybersecurity service. The price increases with data volume and the frequency of copies.
