Backup Strategy
The 3-2-1 rule + immutable backups against ransomware
TL;DR
A backup strategy defines backup frequency, storage location, retention period and test procedures. The industry standard is 3-2-1: 3 copies, 2 media, 1 offsite.
What is a backup strategy?
Minimum backup standard for 2026:
- 3 copies of the data (the original + 2 backups)
- 2 different media (e.g. a local SAN + cloud)
- 1 offsite (cloud, another site)
- Immutable (against ransomware) — Veeam hardened repositories, S3 Object Lock
- Quarterly restore tests
Practical example
An SME with a data volume of 5 TB: a daily incremental backup to NAS, a weekly full backup to tape cartridge + an immutable S3 backup. RTO 4h, RPO 24h.
Frequently asked questions
How long should backups be retained?
Is the cloud secure?
Legal basis: Germany and Austria
Backup management is one of the statutory minimum measures of NIS2 risk management (under EU law, Art. 21(2) of the NIS2 Directive (Directive (EU) 2022/2555)). The 3-2-1 rule and immutable backups are a recognised industry standard here, not a legally prescribed norm. The specific legal reference differs depending on the jurisdiction:
Germany
In Germany, backup management falls under 'maintaining operations' (Aufrechterhaltung des Betriebs) in § 30(2) no. 3 of the German BSI Act (BSIG): 'maintaining operations, such as backup management and disaster recovery, and crisis management'. The competent authority is the Federal Office for Information Security (BSI). § 30(2) no. 5 BSIG does not apply — that point concerns security measures in the acquisition, development and maintenance of IT systems, including vulnerability management.
Austria
In Austria, business continuity and backup management is a risk management measure under § 32(4) NISG 2026 (Austrian Network and Information Systems Security Act 2026, BGBl. I Nr. 94/2025). The competent authority is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria), a subordinate authority of the Federal Minister of the Interior — not the BSIG or the BSI.