Cloud Backup Strategy and the 3-2-1 Rule for Indian SMBs

What this means for your business

Indian SMBs without documented security controls face 3× higher breach costs (IBM Cost of a Data Breach 2024). This guide helps you close that gap.

Cloud backup is the single most effective ransomware control available to Indian SMBs — yet most businesses discover this only after an attack has already wiped their data. The 3-2-1 rule (3 copies of data, on 2 different media types, with 1 copy offsite) is the baseline every organisation should meet. Its modern extension, 3-2-1-1-0, adds 1 immutable or air-gapped copy and 0 errors confirmed through verified restores. If your backup strategy does not include immutability and regular restore tests, you do not have a backup strategy — you have a false sense of security.

68%of organisations hit by ransomware had backups targeted or destroyed by attackers (Sophos State of Ransomware 2023)

76%of Indian organisations experienced a cyberattack or breach in 2023 (DSCI Annual Information Security Survey 2023)

Why Backups Are the Real Last Line of Defence

Every security control — firewalls, EDR, patch management — can fail. Ransomware groups know this and have industrialised the process. Modern ransomware does not just encrypt your production data; it actively hunts for backup systems, deletes shadow copies, and exfiltrates data before detonating. If your backup is reachable from the infected machine, it is already compromised.

CERT-In's advisories on ransomware incidents consistently list the absence of tested, isolated backups as the primary factor that converts a recoverable incident into a business-ending one. The organisations that recover quickly are not those with better antivirus — they are those with clean, verified, immutable backups that ransomware could not reach.

🚨

DANGER

Ransomware strains such as those in the Phobos, LockBit, and BlackBasta families enumerate and destroy Windows shadow copies and network-attached backup destinations within minutes of execution. A backup accessible via SMB or a mounted drive is not a safe backup.

The 3-2-1 Rule Explained

The 3-2-1 rule was originally articulated by photographer Peter Krogh and later formalised in enterprise continuity frameworks. It remains the most practical starting framework for any SMB.

Number	What It Means	Example
3	Keep 3 total copies of your data	Production + local backup + cloud
2	Use 2 different media/storage types	Internal SSD + external drive or cloud object storage
1	Store 1 copy offsite	Cloud region different from your primary DC or a colocation facility

The rule prevents single points of failure. A fire, flood, or ransomware event that destroys your office cannot also destroy a properly configured offsite copy.

The Modern Extension: 3-2-1-1-0

The base 3-2-1 rule was designed before ransomware became the dominant threat. The 3-2-1-1-0 extension addresses the gaps:

+1 Immutable or air-gapped copy. Object-lock (WORM — Write Once Read Many) on cloud storage prevents any process, even an administrator account, from modifying or deleting backup objects before a defined retention period expires. An air-gapped copy is physically disconnected from the network entirely.
+0 errors verified. Every backup job must be tested. An untested backup is not a backup — it is an assumption. Quarterly restore drills are the minimum; monthly is better for critical systems.

🛡️

SECURITY

Object Lock in compliance mode (supported by AWS S3, Azure Blob, and many Indian cloud providers) cannot be overridden even by the root/admin account. This is the single most effective technical control against ransomware that compromises your cloud credentials.

Know your vulnerabilities before attackers do

Run a free VAPT scan — takes 5 minutes, no signup required.

Book Your Free Scan

The 3-2-1 Architecture in Practice

graph TD A[Production Data] --> B[Local Backup Copy
NAS or External Drive] A --> C[Second Media Copy
Different Storage Type] C --> D[Offsite Cloud Backup
Regular Backup] D --> E{Ransomware Reaches
Network-Accessible Backup} E -->|Yes — no immutability| F[Backup Encrypted
or Deleted] E -->|No — WORM Object Lock| G[Immutable Copy
Safe and Recoverable] B --> H{Ransomware on LAN} H -->|Yes — shared drive| I[Local Backup Lost] H -->|No — air-gapped| G style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style C fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style E fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style G fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 style H fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style I fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0

Backup vs Replication vs Snapshot: Know the Difference

These three terms are often used interchangeably by vendors and confused by buyers. They are not the same thing.

Feature	Backup	Replication	Snapshot
Purpose	Long-term recovery, ransomware resilience	High availability, failover	Point-in-time rollback
Frequency	Hourly, daily, weekly schedules	Continuous or near-real-time	On-demand or scheduled
Ransomware protection	High (if immutable and offsite)	Low — replication copies encrypted files too	Medium — depends on retention and isolation
RPO	Minutes to hours	Near-zero	Minutes to hours
RTO	Hours (full restore)	Very fast (already live)	Minutes to hours
Offsite by default	Yes (cloud backup)	Usually no	Usually no
Immutability possible	Yes (WORM/object lock)	Rarely	Sometimes

Replication is excellent for availability — a database replica means your application keeps running if the primary server crashes. But if ransomware encrypts the primary, replication faithfully copies the encrypted garbage to the replica within seconds. Replication does not replace backup.

Snapshots are valuable for fast rollbacks of configuration errors or bad deployments. But snapshots stored on the same storage array as production data are destroyed when ransomware hits that array.

RPO and RTO: The Numbers That Matter

Recovery Point Objective (RPO) — the maximum amount of data you can afford to lose, measured in time. If your RPO is four hours, your backup must run at least every four hours. An SMB that backs up daily has an RPO of up to 24 hours, meaning a ransomware attack at 3 PM on a Friday could lose an entire day of transactions.

Recovery Time Objective (RTO) — the maximum time you can afford for systems to be down before the business is seriously damaged. A fintech or e-commerce business may have an RTO measured in hours. A manufacturing firm managing logistics might tolerate a day. These numbers must be defined before an incident, not during one.

💡

TIP

Write your RPO and RTO in your backup policy document. Share them with your IT team or managed service provider. When evaluating a backup solution, test whether it can actually meet those numbers — not in marketing materials, but in a real restore drill.

Immutability and WORM: Technical Controls Against Ransomware

Object-lock (WORM) is the technical mechanism that enforces immutability on cloud object storage. When a backup is uploaded with an object-lock retention period, no API call — including delete and overwrite — can remove or modify that object until the retention window expires.

Two modes typically exist:

Governance mode: Administrators with special IAM permissions can still override the lock. Useful during testing.
Compliance mode: No entity, including the root account, can delete the object before the retention period ends. This is the mode that matters for ransomware protection.

For Indian SMBs using AWS, Azure, or GCP, enabling object lock on backup buckets is a configuration change — not a major engineering project. If you use a managed backup service, verify explicitly that it supports and enforces object lock in compliance mode.

Data Residency and Indian Regulatory Considerations

Under India's Digital Personal Data Protection (DPDP) Act 2023, the rules on cross-border data transfers are still being finalised through subordinate rules. However, several sector-specific regulations already govern where data must reside:

RBI-regulated entities (NBFCs, payment aggregators, fintechs) must store payment system data exclusively in India under RBI's 2018 circular.
IRDAI-regulated entities (insurance) must store policyholder data in India.
Healthcare data is increasingly treated as sensitive under IT Act and DPDP principles.

For most Indian SMBs, choosing a backup destination in an Indian cloud region (AWS ap-south-1 Mumbai, Azure India Central, or Indian cloud providers such as NIC Cloud, Yotta, or CtrlS) is both a regulatory safeguard and a practical latency improvement for restores. If you use an international region, document the legal basis and review it as DPDP subordinate rules are published.

Visit our DPDP compliance guide for a detailed breakdown of how the DPDP Act 2023 affects data storage obligations.

Building a Cloud Backup Policy for an Indian SMB

A backup policy does not need to be a 40-page document. It needs to answer the following questions:

Question	Minimum Acceptable Answer
What data is being backed up?	All business-critical data: databases, file servers, email, configuration
Where are backups stored?	At least one offsite or cloud copy with object lock enabled
How often do backups run?	Daily minimum; hourly for databases and transaction systems
What is the retention period?	30 days minimum; 90 days recommended for ransomware (dwell time can exceed 30 days)
Are backups encrypted?	Yes — AES-256 at rest, TLS in transit
Who can access backup credentials?	Separate privileged account, MFA enforced, not used for day-to-day work
When was the last restore test?	Within the last 90 days, documented
What are the RPO and RTO?	Defined, agreed with business owners, tested

pie title Primary Causes of Business Data Loss "Ransomware and Malware" : 36 "Hardware Failure" : 29 "Human Error and Accidental Deletion" : 21 "Natural Disasters and Physical Damage" : 8 "Insider Threats and Theft" : 6

⚠️

WARNING

Ransomware dwell time — the period between initial infection and detonation — has consistently exceeded three weeks in incident response engagements tracked by IBM's X-Force Threat Intelligence Index. A 14-day or 30-day backup retention window may not be enough if an attacker has been dormant in your environment for a month before encrypting. Set retention to at least 90 days for critical systems.

Encryption: Protecting Backups in Transit and at Rest

Backups themselves must be encrypted to prevent a different class of threat: data exfiltration. Attackers who cannot deploy ransomware may instead exfiltrate your unencrypted backup archive and demand payment to not publish it.

Minimum encryption requirements:

At rest: AES-256 encryption on the backup storage target. For cloud backups, enable server-side encryption with a customer-managed key (CMK) where possible.
In transit: TLS 1.2 minimum, TLS 1.3 preferred, for all backup data moving to cloud destinations.
Key management: Encryption keys must be stored separately from the backup data. A key stored in the same account that holds the encrypted backup is not meaningful protection.

NIST SP 800-111 provides guidance on storage encryption that is directly applicable to backup systems. CISA's Ransomware Guide explicitly lists encrypted, offline, air-gapped backups as the primary recovery control.

The Restore Test Is Not Optional

CERT-In's cyber hygiene guidelines and NIST SP 800-34 (Contingency Planning Guide for Federal Information Systems) both treat backup verification as a mandatory control, not a nice-to-have. The principle is simple: a backup that has never been restored is a hypothesis, not a recovery asset.

A restore test should confirm:

The backup data is actually present and readable (not just a successful backup job log).
The restored data is consistent and usable — databases come up, application configurations are correct.
The restore completed within your defined RTO.
The process is documented so that a team member who was not involved in setting up the backup can execute the restore.

At Bachao.AI (built by Dhisattva AI Pvt Ltd), we see backup verification gaps flagged regularly during automated VAPT assessments — particularly for organisations that have backup jobs configured but have never confirmed that the resulting data is actually restorable. A free VAPT scan will surface these gaps in your infrastructure alongside your other security posture issues.

🎯Key Takeaway

A backup strategy is only as strong as your last verified restore. The 3-2-1-1-0 rule gives you the architecture; immutable object-lock copies give you protection against ransomware that hunts backups; and quarterly restore drills give you the only honest measurement of whether you can actually recover. Define your RPO and RTO before an incident forces you to guess.

External Resources

CERT-In Cyber Hygiene Guidelines — India's nodal agency for cybersecurity incident response.
CISA StopRansomware Guide — Practical ransomware recovery controls including backup isolation requirements.
NIST SP 800-34 Contingency Planning Guide — The foundational framework for RPO, RTO, and backup testing requirements.

Frequently Asked Questions

What is the 3-2-1 backup rule and why does it matter for Indian SMBs?

The 3-2-1 rule means keeping 3 copies of your data on 2 different storage media types with 1 copy stored offsite. For Indian SMBs, it matters because a single ransomware attack or a local disaster can destroy on-premise backups instantly. An offsite copy that ransomware cannot reach is what separates a recoverable incident from a business-ending one.

What is the difference between the 3-2-1 rule and the 3-2-1-1-0 rule?

The 3-2-1-1-0 rule extends the base framework by requiring 1 immutable or air-gapped copy (one that cannot be modified or deleted by ransomware even if it compromises cloud credentials) and 0 errors as confirmed through verified restore testing. The original 3-2-1 rule was designed before ransomware routinely targeted and destroyed backup systems.

Does CERT-In require organisations to have a backup policy?

CERT-In's cyber hygiene guidelines strongly recommend tested, isolated backups as a baseline security control, and CERT-In's incident response advisories consistently cite the absence of verified backups as a primary factor in severe ransomware outcomes. For entities under specific sector regulations (RBI, IRDAI, SEBI), backup and business continuity requirements may be explicitly mandatory.

What is RPO and RTO, and how do I calculate them for my business?

RPO (Recovery Point Objective) is the maximum data loss you can tolerate, expressed in time — for example, 4 hours means your last backup can be at most 4 hours old when disaster strikes. RTO (Recovery Time Objective) is the maximum downtime you can tolerate before significant business damage occurs. Calculate both by asking your business owners: how many hours of lost transactions or lost data would be catastrophic? That number is your target RPO and RTO.

Where should Indian SMBs store their offsite backups?

For most Indian SMBs, a cloud backup destination in an Indian region (such as AWS Mumbai, Azure India Central, or an Indian cloud provider) is the practical choice. It satisfies RBI data-localisation requirements for payment data, reduces latency for restores, and avoids DPDP cross-border transfer complexity as the Act's subordinate rules are finalised.

An untested backup is not a backup — what does a restore test actually involve?

A restore test involves taking a recent backup, restoring it to a separate isolated environment (not production), verifying that the data is complete and consistent, confirming that applications come up correctly using the restored data, and documenting the time taken. This should happen at minimum quarterly for critical systems. Many organisations that run daily backup jobs discover during their first restore test that the backups have been silently failing or producing corrupt archives.

BR

Bachao.AI Research Team

Cybersecurity Research

AI-powered security research and threat intelligence from the Bachao.AI team. Covering the latest vulnerabilities, CVEs, and cybersecurity developments affecting Indian businesses.

Get cybersecurity insights for Indian SMBs

Weekly vulnerability alerts, DPDP compliance tips, and security guides. No spam — unsubscribe anytime.

We respect your privacy. Your email is never shared.