For years, the standard advice for ransomware was simple: keep good backups and you can always restore. That advice is still true — but attackers have adapted, and a backup strategy that would have saved you a decade ago can fail completely today.
Modern ransomware groups know that backups are their biggest obstacle. So before they encrypt your systems, they go looking for your backups to delete or encrypt them first. If they succeed, you are left with no clean copy and a ransom demand.
A ransomware-ready backup strategy is built specifically to survive that.
Start with the 3-2-1 rule
The 3-2-1 rule remains the foundation, and it still holds up:
- 3 copies of your data.
- 2 different types of storage.
- 1 copy kept off-site.
The principle is that no single failure — a dead drive, a fire, a compromised server — takes out every copy at once. It is simple, and it is still where every good strategy starts. But in 2026 it is no longer enough on its own.
Add immutability
The single most important upgrade is immutable backups. Immutable means a backup, once written, cannot be altered or deleted for a set retention period — not by an administrator, not by malware, not even by a compromised account with full privileges.
This is what defeats the modern attack pattern. Even if an attacker gets into your environment and tries to destroy the backups, the immutable copies simply cannot be touched until their retention window expires. When the dust settles, you still have a clean copy to restore from.
Isolate the backups
Related to immutability is isolation. Your backups should not be reachable from a normal, day-to-day compromised workstation. Techniques like air-gapped or logically separated storage, and separate credentials for the backup system, mean that breaching your network does not automatically hand an attacker your recovery plan.
Know your RPO and RTO
Two terms are worth learning because they turn "we have backups" into a real plan:
- RPO (Recovery Point Objective) — how much data you can afford to lose, measured in time. If you back up once a day, your RPO is up to 24 hours of work.
- RTO (Recovery Time Objective) — how quickly you need to be running again after an incident.
Decide these deliberately based on what your business can tolerate, then design the backup schedule and recovery process to meet them. A daily backup may be fine for some data and nowhere near enough for a busy transactional system.
Test your restores
This is the step almost everyone skips, and it is the one that matters most. A backup you have never restored is not a backup — it is a hope. Backups fail silently all the time: a job that stopped running months ago, a corrupted file, a configuration that never actually captured the important data.
The only way to know you can recover is to regularly perform a test restore and confirm the data comes back intact and usable. Do this on a schedule, not just after an incident.
A quick checklist
A genuinely ransomware-ready strategy has all of these:
- Multiple copies following the 3-2-1 rule.
- At least one immutable copy that cannot be deleted within its retention period.
- Backups isolated from everyday systems and credentials.
- Clearly defined RPO and RTO that match the business.
- Regular, documented test restores that actually work.
The takeaway
Ransomware is no longer a question of "if" for most businesses — it is a question of whether you can recover without paying. Immutable, isolated, tested backups are what turn a potential catastrophe into an inconvenience.
If you are not certain your current backups would survive a determined attack, that is exactly the gap worth closing before you need it — not after.