The backup that really saves you: the 3-2-1-1-0 rule in plain English

When did you last restore a file from your backup? Not back up – restore.

If you have to think about it for a moment, you're in good company. Many companies dutifully back up but never test. You only notice when it really matters: after a hard drive failure, an accidentally deleted folder or an attack with extortion software, known as ransomware.

Why ransomware loves backups

Ransomware encrypts data and demands a ransom for the key. Attackers deliberately look for backups so they can encrypt or delete those too. According to the Bundeslagebild Cybercrime 2025 (the national cybercrime situation report) by the BKA (Germany's Federal Criminal Police Office), 1.041 ransomware attacks were reported in Germany, around ten per cent more than the previous year. About 90 per cent hit small and medium-sized businesses. And: only around seven per cent of those affected paid. The BKA sees this as a sign that many companies have become more resilient – and good backups are exactly part of that.

The rule: 3-2-1-1-0

The well-known 3-2-1 rule is a rule of thumb from practice. With ransomware in mind, it has grown by two digits:

In its ransomware measures, the BSI (Germany's Federal Office for Information Security) explicitly recommends an offline backup that is disconnected from the rest of the network after backing up, and a tested restore. “Immutable” means: nobody can change or delete the backup for a set period, not even an administrator – and therefore not an attacker with stolen admin access either.

What actually belongs in the backup?

More than you think. Not just the “Customers” folder, but also:

• Mailboxes: Many email services keep deleted emails only for a limited time. Your own backup protects against mistakes and attacks.
• Website and shop: files and database, ideally daily – and not just with the same provider.
• Accounting and industry software: often on a single computer that has “always been there”.
• Logins and settings: Who has which password, how was the router set up? The Lost Monster calls this the emergency folder.

Then there's the question of how far back you can go. If you only keep last night's backup, you've also backed up yesterday's encryption. Several versions over days and weeks are therefore a must.

Syncing is not a backup

A common misconception: “But our files are in the cloud.” A folder that's synced between computer and cloud is handy – but it's not a backup. If a file on the computer is encrypted or deleted, the same thing happens in the cloud shortly afterwards. Some services offer a recycle bin or older versions, but often only for a limited time and not for everything.

It's a similar story with an external hard drive that's permanently connected to the computer. It's convenient, but ransomware can reach it just as easily as the built-in drive. Only when the copy is disconnected, immutable or stored with a separate backup service with versions does it count in the sense of the rule. To be honest, these are the questions that clear up the most in conversations: what is merely mirrored, and what is really backed up?

The test hardly anyone does

One hour once a quarter: restore a random file, a mailbox or the website from the backup – onto a test computer, not over the original. Note how long it took and whether everything was there. That's all there is to it. This little test is the “0” in the rule and the difference between “We have a backup” and “We can get back up and running”.

The order in an emergency matters too: what has to be running again first? Usually email, phone and accounting – the website often only after that. Write it down on one page and put a printout where it can be found even without a computer.

The Backup Monster sets up backups following the 3-2-1-1-0 rule – on our infrastructure, on yours or with a provider on the market – and regularly tests the restore with you. For your own server in the background, there's the Server Monster.