Attackers now delete or encrypt backups before launching ransomware. Immutable, isolated and verified backups are what make recovery possible.
| Element | Meaning |
|---|---|
| 3 | Three copies of data — production plus two backups |
| 2 | Two different media or storage types |
| 1 | One copy off-site |
| 1 | One copy immutable or offline |
| 0 | Zero errors in verified restore tests |
Immutable storage prevents data from being changed or deleted for a set retention period, even by administrators. Options include object storage with object lock, hardened Linux repositories, purpose-built backup appliances and tape kept offline.
Automate restore testing where possible — boot backed-up virtual machines in an isolated network and check that applications start. Record results as evidence.
After ransomware, restoring the latest backup may restore the attacker's foothold. Scan backups for indicators of compromise, use an isolated recovery environment and rebuild identity services from trusted media.
NCA ECC backup and recovery management controls require periodic backups and restore testing; immutable, verified backups provide strong evidence for assessors.
| Option | Strengths | Considerations |
|---|---|---|
| Object storage with object lock | Scalable, cloud or on-premises | Configure compliance mode correctly |
| Hardened Linux repository | Cost-effective, flexible | Requires strict hardening and access control |
| Purpose-built appliance | Integrated, simple | Vendor lock-in |
| Tape (offline) | True air gap, low cost per TB | Slower restores |
Balance recovery needs against cost. Daily backups retained for a month, weekly for several months and monthly for a year is a common baseline, adjusted for legal requirements. Keep immutable retention long enough to cover attackers' dwell time.
Monitor job success, capacity, immutability settings and unusual changes in backup size or change rates, which can indicate encryption in progress.
We design and implement backup architectures with immutability, isolated recovery environments and automated restore testing, and can manage backup operations as a service.
Next step: see Business Resilience Solutions and Data Center Services.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
Hardware refreshes, virtualization licensing changes and hybrid cloud are forcing infrastructure decisions. A neutral guide to the options and how to choose.
The DCC extends the ECC with controls that scale with data classification. What it requires and how to align it with PDPL and national data management rules.
Customers abandon brands that lose their data. Protecting payments, accounts and websites in retail and e-commerce — especially during peak trading.
Tell us what you are working on. A senior NAZZTEC consultant will come back within one business day with a practical view.
We respond to every enquiry within one business day.