Grandad’s backup: three drawers, a sealed envelope and a restore test

A company’s backup is reliable when it follows the 3-2-1 rule (three copies of the data, on two different media, one of them off site), adds an isolated copy that nobody can alter from the network, and is tested with real restores until there are zero errors. The full formula is written 3-2-1-1-0. Before any copies, though, comes a decision that belongs to management. For each service, how much data can you afford to lose, and how long can it stay down? Those two answers determine how often you copy, which technologies you use and what it all costs.

Grandad’s three drawers

The grandfather in this story kept his important papers in three places. One was the desk drawer in his study, one was a folder in the chest of drawers in the bedroom, and one was an envelope at Auntie’s, out in the country. When anyone asked him why, he would answer: “If the study goes up in flames, I’ve still got the chest of drawers and Auntie.”

Two details make his method more modern than many company plans. The envelope at Auntie’s was sealed, so nobody could change what was inside without it showing. And once a year grandad opened the drawers, one by one, and checked that all the papers were there and still legible. He had understood something that still holds today. A backup that has never been tested is not a backup. It is a hope.

A typical scenario looks like the opposite. The nightly copies go to a NAS, the office’s network storage unit, which every workstation sees as an ordinary shared folder. Every morning the control panel reports “completed”. Then one day ransomware starts on an employee’s computer, works its way through the shared folders and encrypts the backup folder too. There were three copies on paper and none in reality.

What is the 3-2-1 rule, and why has it become 3-2-1-1-0?

The 3-2-1 rule is the most widely used way of organising backup copies. In recent years practitioners have extended it with two more digits, in response to ransomware and to copies that were never checked.

Where do you start when designing a company’s backup?

You start with the services, not the technology. NIST, the US standards body, uses two measures in its contingency planning guide that are worth adopting in a management meeting too:

• RTO (recovery time objective): how long a system can stay down before the damage becomes unacceptable.
• RPO (recovery point objective): the point in time to which data must be recoverable, in other words how much data you are prepared to lose.

The smaller the two values, the more the solution costs. That is why IT does not set them alone. Management decides them, service by service, and IT turns them into technology. Here is an example of what the table might look like.

The values are only an example. Every company sets them according to its customers, contracts and processes.

What needs copying besides files?

Many plans copy shared folders well and forget what is needed to get them running again.

• Databases, consistently. Copying files while the database is working produces unusable copies. For Oracle you use the native tools, such as RMAN, with regular restore tests. This is part of the work of our Oracle & Database Engineering division.
• Identity systems. Without the user directory, nobody can log in to freshly restored systems.
• Configurations. Rebuilding the settings of firewalls, network, remote access and the phone system from memory in an emergency takes days.
• Cloud services. The provider is normally responsible for keeping the service available, not always for what a user deletes or an attacker encrypts. Check the contract to see what can be recovered, and for how long.
• Reference images of critical systems. CISA, the US cybersecurity agency, recommends keeping up-to-date, preconfigured images to restart from quickly.
• Backup keys and credentials. The encryption keys for the copies and access to the backup console must be kept outside the systems they protect.
• The recovery document. It sets out the restore order, who is responsible and whom to contact, and it should exist on paper as well.
• The archive behind AI assistants. If the company uses a Company Brain, an assistant that answers questions from internal documents and serves as the company’s own searchable memory, the plan must also cover its archive, its indexes and its access rules. Without the rules, an assistant restored in a hurry could show everyone what was confidential.

Why does the isolated copy make the difference?

Because anyone who breaks into your systems goes looking for the copies. According to the latest annual report from ENISA, the EU cybersecurity agency, ransomware remains the threat with the greatest impact in the European Union. Its authors know that a company with intact copies has no reason to pay. CISA’s #StopRansomware Guide warns that many ransomware variants try to find and delete any backups they can reach, and it recommends offline, encrypted copies. In practice:

• At least one copy cannot be reached from the company network, or is locked against changes for a set period.
• The backup console has its own accounts, which do not exist in the company directory, and it requires a second factor. A reused password, as in the story of the reused password that opened every door, must not be able to open that door as well.
• Alerts go out when someone changes retention periods or deletes copies.

The same guide points out a limit. Immutable copies, if badly configured, can be very expensive, and they do not always sit well with the retention rules for certain data. The length of the lock is therefore decided together with legal counsel and whoever is responsible for data protection.

How do you prove that a restore works?

By restoring. Article 32 of the GDPR requires anyone who processes personal data to be able to restore it in a timely manner after an incident, and to have a process for regularly testing the effectiveness of the measures. San Marino Law 171/2018, the Republic’s data protection law, repeats this in Article 33. For companies subject to NIS2, the EU directive on network and information security, backup testing is among the basic measures set out by Italy’s National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN).

Every test goes into a record: date, system, copy used, actual time, outcome, problems found and corrections. The record does two jobs. It shows whether the real recovery time matches the one management decided. And it answers customer questionnaires, which increasingly ask for the date of the last test restore.

Who is responsible for backup when a supplier runs the systems?

You can hand over the work. You cannot hand over the responsibility for knowing whether it works. The supplier contract should state what is copied and where, for how long, who runs the tests and how often, who can access the copies, how quickly a restore happens and what becomes of the copies when the relationship ends. And the company must receive the test reports, not just the invoices.

In brief

• The 3-2-1-1-0 rule calls for three copies, on two media, one off site, one isolated, and zero errors in testing.
• You start from two management decisions for each service: how much data can be lost and how long the service can stay down.
• Besides files, you need copies of databases, identities, configurations, cloud services, keys and procedures.
• An isolated copy and a backup console with its own accounts stop an attacker from destroying the copies too.
• Only a recorded restore proves that the backup works, and that the real times are the ones decided.

Frequently asked questions

Does real-time replication count as a backup?

No. Replication instantly copies errors, deletions and files encrypted by ransomware as well. It helps reduce downtime, but it has to sit alongside copies with several versions over time, so that you can choose a moment before the problem.

How long should copies be kept?

It depends on three factors: how long a problem can go unnoticed, the retention obligations for documents and accounting records, and the principle that personal data is kept only as long as necessary. Practitioners often use a rotation scheme actually called grandfather-father-son (GFS). The most recent copies, the “sons”, are replaced quickly, the “fathers” last longer and the “grandfathers” are kept for months. The length of each level is decided with the finance and administration team and with the data protection officer.

Does a backup also protect against data theft?

No. It lets you get back up and running, but it does not stop whoever stole the data from publishing it or using it for blackmail. That is why the copies must be encrypted, and why the defences that prevent access remain essential.

Who should approve the backup plan?

Management, together with whoever runs the systems. Acceptable downtime and data loss are business decisions, because every reduction has a cost. IT’s job is to turn them into technology and to prove through testing that they are being met.

Setting acceptable times for each service, designing isolated copies and repeating tests on a schedule is part of our work on business continuity and disaster recovery within the Cybersecurity division. The first step is often the same as grandad’s. Open the drawers and look at what is really inside.

Sources

Consulted on 16 September 2026.

• CISA, #StopRansomware Guide, September 2023 version
• NIST, SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems, May 2010
• ENISA, Threat Landscape 2025, October 2025
• Regulation (EU) 2016/679 (GDPR), Article 32, EUR-Lex
• Great and General Council of San Marino (Consiglio Grande e Generale), Law 171 of 21 December 2018, Article 33 (in Italian)
• Italy’s National Cybersecurity Agency (ACN), NIS frequently asked questions – Basic measures and notifications (in Italian)