The 3-2-1-1-0 Backup Rule: Why 3-2-1 Fails Against Ransomware (And What Ontario Practices Need Instead)

A backup job can report success on Friday and still leave a practice unable to recover on Monday. If ransomware reaches the same network as the backup, attackers may try to delete or encrypt both. In Veeam’s 2023 research, backup repositories were targeted in 93% of reported ransomware incidents; 75% of organizations said they lost at least some repositories. Those figures describe reported incidents, not every ransomware attack, but they underline an important point: a backup is only useful if it survives the incident and can be restored.

The 3-2-1 backup rule remains a strong starting point. For law firms, CPA practices, wealth managers and other professional offices in Ottawa and Eastern Ontario, it needs extra protection: an immutable copy and tested restores.

What is the 3-2-1 backup rule?

The traditional rule says to keep:

• 3 copies of your important data, including the production copy.
• 2 different types of storage media, reducing the chance that one kind of failure affects every copy.
• 1 copy off-site, so a fire, flood or theft at the office does not destroy everything.

It is a simple way to avoid relying on one device or one location. A practice might have its working files, a local backup appliance and a separate off-site copy.

The weakness is that “separate” does not always mean “out of reach.” If backup storage is connected to the office network and managed with credentials an attacker can compromise, ransomware may be able to reach it too. Veeam’s findings show how often attackers target backup repositories, but the risk is not limited to a particular product or firm size.

Why 3-2-1 alone may not stop ransomware

Network-connected backups can share the same risk

A mapped drive, network share or backup server may be accessible from compromised computers or administrator accounts. Attackers often look for backup systems and recovery tools as they move through a network. If they can alter or delete the backup, the practice may lose its recovery path just when it needs it most.

A resilient design separates backup storage and administration from ordinary user accounts and the Windows domain. It also keeps at least one copy that cannot be changed during its retention period.

Sync is not the same as an independent backup

OneDrive and SharePoint are useful collaboration and file-sync services. But if an encrypted, corrupted or deleted file is synchronized, that change can affect other synced locations. Version history and recycle bins can help recover some data, but should not be the only recovery plan.

For example, Microsoft documents a 93-day recycle-bin period for SharePoint items, with separate service-recovery processes under specific conditions. That is not the same as retaining usable business records for six or seven years. See Microsoft’s guidance on SharePoint data deletion and ransomware protection in Microsoft 365.

A backup is not automatically a long-term archive

The Canada Revenue Agency’s electronic record-keeping guidance says records must be restorable in an accessible, usable format, and that backup procedures should include periodic restoration testing. The Income Tax Act, section 230 generally requires relevant books and records to be kept for six years after the end of the taxation year to which they relate.

A short recycle-bin window is plainly not a substitute for a retention plan. But neither does a longer backup retention period automatically meet every legal or professional obligation. Practices should set retention by record type, account for legal holds and dispose of information when it is no longer required. The Ontario Limitations Act includes a 15-year ultimate limitation period for certain proceedings; that is not a blanket requirement to keep every file for 15 years.

“Off-site” does not answer every data-residency question

A copy in another country may protect against a local disaster, but firms handling privileged legal files, tax records or personal information should also understand where data is stored and which providers may control or access it. The U.S. CLOUD Act can apply to providers subject to U.S. jurisdiction and control, even when data is stored outside the United States. Location matters, but so do the provider’s legal entity, access arrangements and contract terms. Canadian hosting alone should not be treated as a complete jurisdictional assessment.

What the extra “1-1-0” adds

The expanded 3-2-1-1-0 backup rule keeps the original three principles and adds two safeguards:

• 1 immutable or offline copy: a copy that cannot be altered or deleted during its protection period, even if production credentials are compromised.
• 0 unverified restore errors: recovery is checked through integrity scans and test restores, not assumed from a successful backup report.

What is immutable backup?

What is immutable backup? It is a backup stored under rules that prevent it from being modified or deleted for a defined period. WORM means “Write Once, Read Many”: data is written, then protected from changes while the lock is active. Immutability is not a replacement for encryption, access controls, retention planning or testing; it is an additional barrier against tampering.

For example, Canada IT Pro’s architecture pairs a dedicated on-premise appliance running a hardened Linux storage system with local Btrfs WORM snapshots, separated from Windows Active Directory. The appliance uses AES-256-XTS volume encryption at rest. A second copy is replicated to Canadian cloud object storage in ca-central-1 under Wasabi S3 Compliance Mode with a rolling 30-day immutability lock. During that lock period, deletion or alteration requests are rejected by the storage layer.

The lock period and the retention schedule serve different purposes. A 30-day lock is a ransomware-resistance control; it does not by itself provide a seven-year archive. A separate retention policy must preserve the required daily, monthly and yearly recovery points. Canada IT Pro describes a Grandfather-Father-Son schedule of 31 daily, 12 monthly and 7 yearly versions in its backup architecture. Practices should confirm how their own retention settings apply to each class of record.

“Zero errors” means proving recovery works

A backup can exist but still be incomplete, corrupted or difficult to use. Integrity checks and restore tests help identify those problems before an incident.

Canada IT Pro uses SHA-256 block-level checksum validation and scheduled test restores into an isolated staging environment. The aim is to confirm that selected files, and, where relevant, database components, can be restored and read. This aligns with CRA guidance to test whether electronic records can be restored into an accessible and usable format. It is also useful evidence for a practice’s own continuity reviews, though no backup setup alone guarantees compliance.

3-2-1 versus 3-2-1-1-0

Control	Traditional 3-2-1	3-2-1-1-0
Copies	Three, including production	Three, including production
Media	Two types	Two types
Location	One copy off-site	One copy off-site
Ransomware resistance	Not specified; connected copies may be reachable	One immutable or offline copy
Recovery confidence	May rely on backup job status	Zero unverified errors, supported by integrity checks and restore tests

A practical backup checklist for this week

Ask your IT provider or internal administrator:

1. How many independent copies do we have? Identify each copy, its storage type, location and administrator credentials.
2. Can a compromised domain account delete our backups? Check whether backup management is isolated from everyday Windows accounts and production systems.
3. Which copy is immutable or offline? Confirm what is locked, for how long, and who can change the policy.
4. Is Microsoft 365 sync being mistaken for backup? Document how you would recover files after widespread encryption, deletion or account compromise.
5. Can we restore a sample now? Test key documents and a representative database into a safe environment. Record the date, scope, result and any follow-up actions.
6. Does retention match our records? Map business and professional requirements to a documented schedule. Check legal holds and secure disposal as well as retention.

For a small firm in Kanata, Nepean, Orléans, Barrhaven or elsewhere in Eastern Ontario, the best next step is not simply buying more storage. It is checking whether copies are truly independent, protected for the right period and recoverable in practice.

For a low-pressure review, request a 15-minute continuity audit at canadaitpro.com.