Knowledge / IR hardening acsc-glossary

3-2-1 backups

Three copies, two media, one off-site. Immutable or offline beats a snapshot the ransomware also encrypted.

3-2-13 copiesprod + 22 mediadisk + other1 off-siteoffline / immutableA backup you have never restored is a hope, not a control.

3-2-1 is a durability pattern: three copies, two kinds of media, one copy off-site. It is not a ransomware strategy unless one copy cannot be reached with the same credentials as production.

Test restores on a calendar. Time how long until the business can work. That number is your real RTO, not the slide.

Essential Eight includes regular backups for this reason. A backup that has never been restored is a hope.

Fact source: ASD's ACSC glossary. Wording is Cyberstack's.