Backup you can restore: the 3-2-1-1-0 rule
Ransomware goes after backups first. We set up backups attackers cannot reach and prove they work: 3 copies of your data, on 2 kinds of media, 1 off-site, 1 immutable or offline, and 0 errors when we test a restore. You keep the evidence for your assessor and insurer.
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Management“If ransomware hits, can we get our data back?”Backups kept offline or isolated, and tested, give you a way to recover.Cyber Security Agency of Singapore (CSA), read 12 Oct 2026
- Insurers“Are backups offline or isolated, and tested annually?”Insurer proposal forms ask exactly this.MSIG Insurance (Singapore) Pte Ltd, read 12 Oct 2026
- Tender panels and procurement“Do you meet a recognised backup baseline?”Cyber Essentials requires backups stored separately and tested at least twice a year.Cyber Security Agency of Singapore (CSA), read 12 Oct 2026
- Management“Isn’t Microsoft 365 already backed up?”Microsoft says customers always remain responsible for their own data, and it sells backup as a separate service.Microsoft, read 12 Oct 2026
In a case study in the Cyber Security Agency’s SME toolkit, all of a company’s backups were stored on infected servers and could not be restored.
Cyber Security Agency of Singapore (CSA), read 12 Oct 2026The rule in plain words
- 3copies of your data: the original and two backups
- 2kinds of storage, so one failure cannot take both
- 1copy off-site, away from your office and systems
- 1copy immutable or offline: it cannot be changed or deleted
- 0errors when we test a restore
Sources: Veeam, 3-2-1 backup rule; Cyber Security Agency of Singapore, Cyber Essentials (2025) A.8.4; both read 12 October 2026.
Why ransomware targets backups first
If attackers can delete or encrypt your backups, paying is the only way back. The US Cybersecurity and Infrastructure Security Agency (CISA) warns that many ransomware variants try to find and delete or encrypt any backups they can reach. In a case study in the Cyber Security Agency of Singapore’s toolkit for small business owners, every backup sat on the infected servers, and none could be restored.
Sources: CISA and MS-ISAC, #StopRansomware Guide; Cyber Security Agency of Singapore, SG Cyber Safe toolkit for SME owners; both read 12 October 2026.
What we set up
- Microsoft 365: mail, OneDrive, SharePoint and Teams, backed up outside Microsoft’s own service
- File servers and network storage: an immutable copy and an off-site copy
- Business systems, such as accounting or clinic software: scheduled exports, agreed with the vendor
The restore test, and the evidence you keep
- At least twice a year, as Cyber Essentials asks, and after any major change, we restore sample files, a mailbox and a system to a clean machine
- Each test is recorded: the date, what was restored, how long it took and the result
- You keep the backup policy, job reports and restore-test records, mapped to Cyber Essentials A.8.4 and ISO/IEC 27001 Annex A 8.13
Source: Cyber Security Agency of Singapore, Cyber Essentials (2025) A.8.4(i): test backups at least twice a year; read 12 October 2026.
Common questions
Is cloud sync the same as backup?
No. Sync copies deletions and encrypted files too. A backup keeps earlier versions in a separate place that ransomware cannot change.
How often do you test a restore?
At least twice a year, which is what Cyber Essentials asks for, and after any major change to your systems.
Latest PDPC case on this topic · 2026-08-05 · Construction, engineering and manufacturing · Voluntary undertaking
Relying on an IT vendor does not remove your responsibility: know how your servers are secured and maintained, and check the vendor is doing it.
Read the PDPC decision of 5 August 2026, on pdpc.gov.sg (opens in a new tab)Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)