How do you plan, build and verify an immutable backup? A step-by-step guide to the 3-2-1 rule, RPO/RTO targets, lock mode choice and restore testing.
This guide is for IT and security teams that want to plan immutable backup from zero. To learn why you need it, read our article “Attackers Now Target Your Backups.” Here we focus on the implementation steps.
Step 1: Set your targets (RPO and RTO)
First, answer two questions. How much data loss do you accept? How fast must the system come back? The first is RPO. The second is RTO. Set the targets for each system from its business impact.
| System type | Example RPO | Example RTO |
|---|---|---|
| Customer and order database | 15 minutes | 1 hour |
| File server | 4 hours | 8 hours |
| Archives and reports | 24 hours | 72 hours |
The values in the table are examples. Set your own targets with a business impact analysis.
Step 2: Apply the 3-2-1 rule
Keep 3 copies of the data. Store them on 2 different media. Keep 1 copy away from the main site. In modern practice, one copy must also be immutable.
Step 3: Choose the lock mode
- Compliance mode: Nobody can remove the lock before the retention period ends. Recommended for ransomware resilience.
- Governance mode: A privileged user can remove the lock. This creates a risk if the account is stolen.
Step 4: Set retention and identity separation
- Choose a period longer than the time it takes you to notice an attack.
- Keep management of the backup store apart from the Domain Admin account.
- Use multi-factor authentication on the backup account.
Step 5: Test the restore
An untested backup is not a reliable backup. Every quarter, restore at least one critical system from backup. Measure the real time and compare it with your RTO. Record the result. This record is audit evidence for ISO 27001:2022 control A.8.13 (information backup).
Step 6: Combine with isolation and detection
Backup is the last line of defense. You must first see the attack early. Endpoint monitoring, patch management and the ability to cut an affected device from the network reduce the amount of data you must recover. Moftgate combines isolation with an immutable, WORM-locked backup in this scope.
Implementation checklist
- RPO and RTO are written down for each critical system.
- At least one copy is immutable and separate from the main site.
- Lock mode is set to “compliance.”
- Backup management uses a separate identity.
- A restore test ran in the last 90 days.
The Moftgate engineering team works on endpoint management, data loss prevention and ransomware resilience.
Expert Answers to Core Practitioner Questions
Is cloud object storage enough for immutable backup?
Yes, if it has an object-lock feature and runs in compliance mode. Set the lock mode and retention period correctly.
How often should I test a restore?
At least every quarter for critical systems. Also test after major infrastructure changes.