Cloud

3-2-1-1-0 Backup Rule for Philippine Businesses: The Modern DR Standard Explained

October 16, 2026 · min read · Technica Solutions

89% of ransomware attacks now target backup repositories before encrypting production data, according to Veeam's 2025 Ransomware Trends Report. The attacker's playbook: compromise the backup admin account, delete all recovery points, then deploy encryption. Your daily backup job completes successfully—but every restore point is gone before the attack even starts.

The original 3-2-1 backup rule was written in a pre-cloud, pre-ransomware era. It worked when data loss meant hardware failure or accidental deletion. In 2026, the threat is deliberate sabotage of your disaster recovery plan.

The modern standard is 3-2-1-1-0—adding immutable copies and verified testing. CISA (US Cybersecurity & Infrastructure Security Agency) explicitly endorses this variant in the joint #StopRansomware Guide. Philippine cyber-insurance carriers now condition ransomware coverage on the +1 (immutable) and +0 (verified testing) requirements.

This guide breaks down the 3-2-1-1-0 rule, explains why the original 3-2-1 is insufficient, and maps implementation patterns for Philippine SMEs.

What Is the 3-2-1-1-0 Backup Rule?

The Original 3-2-1 Rule (Peter Krogh, 2005)

3 copies of your data
2 different storage media types
1 offsite copy

The Modern 3-2-1-1-0 Rule (2026 Standard)

3 copies of your data
2 different storage media types
1 offsite copy
+1 immutable or air-gapped copy (ransomware protection)
+0 zero errors verified through quarterly restore testing

Breaking Down Each Number

3 Copies

1 production copy + 2 backup copies

If your only backup is the Synology NAS sitting next to the server, you have 2 copies—not 3. A fire, flood, or theft destroys both. Ransomware encrypts both (NAS shares are network-mounted).

Philippine context: Typhoon season (June–November) floods server rooms in Metro Manila annually. Production + backup in the same building = both copies gone.

2 Different Media

Disk + tape, or disk + cloud, or NAS + object storage

Why: Media failures often share common modes. A RAID controller firmware bug corrupts all disks in an array simultaneously. A ransomware strain designed to encrypt NTFS volumes hits both your Windows server and your Windows-formatted USB backup drive.

Philippine implementation: Most SMEs use local NAS + cloud storage (Azure Blob or Veeam Cloud Connect). Fewer use tape (LTO-9 drives cost ₱350,000+).

1 Offsite

Geographically separate location

BSP Circular 1082 (Technology Risk Management for Financial Institutions) mandates offsite backups for banks and payment service providers. "Offsite" means a different building—not just a different floor.

Philippine options:

Cloud storage (Azure Southeast Asia in Singapore, GCP asia-southeast1)
Managed backup vault (Technica offers Veeam Cloud Connect in Singapore region)
Physical rotation (weekly tape/disk transport to branch office or secure storage facility)

Not offsite: A second NAS in the same server room. A cloud VM in the same region as production (Azure Southeast Asia → Azure Southeast Asia). Both are acceptable for fast recovery, but they don't satisfy "offsite" for DR purposes.

The Critical Additions: +1 and +0

+1: Immutable or Air-Gapped

At least one backup copy must be immutable (WORM) or physically air-gapped.

Why this was added: Modern ransomware actively searches for backup repositories. Attackers compromise the backup admin account (often via phishing or credential reuse), then delete all recovery points before deploying encryption. Your backup software runs successfully every night—but every snapshot is deleted before you need it.

Sophos's 2025 Active Adversary Report found 57% of ransomware attacks successfully compromised the victim's backup infrastructure.

What "immutable" means:

An immutable backup cannot be modified, overwritten, or deleted for a defined period—even by an administrator. The most common implementation is object storage with WORM protection:

Azure Blob Storage: Immutability policies (time-based retention, legal hold)
AWS S3: Object Lock (WORM mode)
Veeam Immutability: Hardened Linux repository with XFS reflink immutability
Acronis Cyber Protect: Immutable cloud tier

What "air-gapped" means:

The backup copy is physically or logically disconnected from any network. Ransomware cannot reach it because there is no network path.

Physical air gap: LTO tape removed from the drive, stored offsite
Logical air gap: Cloud repository with separate credentials, no standing network mount (written via API, not SMB/NFS)

Philippine implementation patterns:

Pattern	Immutable?	Air-gapped?	Cost
Azure Blob with immutability policy	✅ Yes	❌ No (always connected)	~₱0.90/GB/month
Veeam Cloud Connect (Technica-managed)	✅ Yes (hardened repo)	✅ Logical (API-only)	~₱0.80/GB/month
LTO-9 tape, rotated offsite weekly	✅ Yes (WORM tape)	✅ Physical	₱350K drive + ₱4,500/tape
Acronis Cyber Protect cloud tier	✅ Yes (cloud immutability)	❌ No	Bundled in license

Most Philippine SMEs choose Azure Blob or Veeam Cloud Connect—tape is cost-effective for large datasets (>10TB) but requires manual rotation discipline.

+0: Zero Errors (Verified Recovery)

Backups must be tested quarterly to verify they actually restore.

An untested backup is not a backup. Gartner estimates 30% of backup jobs that report "success" cannot actually be restored due to misconfigured application snapshots, corrupted archives, or dependency failures (missing SQL transaction logs, orphaned VMDK files).

What "zero errors" means:

Automated restore testing: Veeam SureBackup, Acronis Instant Restore verification
Manual DR drill: Quarterly restore of a full VM or database to an isolated network, verify application functionality
Documentation: Test results logged (pass/fail, RPO/RTO achieved, issues encountered)

BSP Circular 1082 (Section 4.3.4) mandates annual DR testing for banks. The 3-2-1-1-0 rule raises this to quarterly—because ransomware moves faster than annual audit cycles.

Philippine implementation:

Most Philippine SMEs use Veeam SureBackup (automated) or Acronis Instant Restore (manual). Both boot a VM directly from the backup repository in an isolated sandbox, run automated tests (ping, SQL query, HTTP health check), and generate a pass/fail report.

Without automated testing: Schedule a quarterly DR drill. Restore one VM, one database, and one file share to a test environment. Verify users can log in, applications start, data is intact.

Why the Original 3-2-1 Is Insufficient in 2026

The 3-2-1 rule was designed for accidental data loss—hardware failure, user error, natural disaster. It assumes your backups are trustworthy and available when needed.

Ransomware breaks both assumptions:

Backups are sabotaged before the attack. Attackers delete snapshots, corrupt repositories, or encrypt backup files themselves.
Network-mounted backups are encrypted alongside production. Your Synology NAS is mounted as \\backup-nas\share—ransomware encrypts it like any other drive.

The 3-2-1 rule does not account for deliberate adversarial action. The +1 (immutable/air-gapped) addition solves this—if the attacker cannot delete or encrypt a copy, recovery is possible.

Common Mistakes Philippine SMEs Make

Mistake 1: All Copies Are Network-Mounted

Setup: Production server → daily backup to NAS → weekly copy to another NAS in the same server room.

Problem: Both NAS devices are SMB/NFS shares visible to the domain. Ransomware encrypts all three (production + both backups) in a single attack.

Fix: Make the second copy immutable (Azure Blob) or air-gapped (tape, Veeam Cloud Connect API-only repository).

Mistake 2: Cloud Backups with No Immutability

Setup: Veeam backs up to a Windows file server, then replicates to Azure VM running Windows Server.

Problem: The Azure VM is network-accessible via RDP and SMB. Compromised admin credentials = attacker deletes cloud backups too.

Fix: Use Azure Blob Storage with a time-based immutability policy (minimum 14 days). Even an admin cannot delete snapshots before the retention period expires.

Mistake 3: Never Testing Restores

Setup: Backup software reports "Success" daily. No one has ever restored a file.

Problem: The backup job may complete successfully, but VSS snapshots fail for SQL Server (no transaction log truncation), Exchange backups are corrupt, or VM snapshots are missing the boot disk.

Fix: Quarterly DR drill—restore one VM to a test environment, verify it boots and users can log in. Document the result.

Mistake 4: "Offsite" Means Another Floor

Setup: Production in 4th floor server room, backup NAS in 3rd floor office.

Problem: Same building = both destroyed by fire, flood, or physical theft. Not offsite for BSP audit purposes.

Fix: Cloud replication (Azure Southeast Asia) or physical rotation to a branch office >10km away.

Implementation Roadmap for Philippine SMEs

Step 1: Audit Your Current Backup (Week 1)

Answer these questions:

Question	3-2-1-1-0 Requirement
How many copies exist?	≥3 (1 production + 2 backups)
Are they on different media?	Disk + cloud, disk + tape, NAS + object storage
Is one copy offsite (>10km)?	Yes—different building, or Singapore cloud region
Is one copy immutable or air-gapped?	Yes—WORM, tape, or hardened repository
When did you last test a restore?	<90 days

If any answer is "No" or "I don't know," your backup does not meet the 3-2-1-1-0 standard.

Step 2: Add an Immutable Offsite Copy (Week 2–3)

Option A: Azure Blob Storage (₱0.90/GB/month)

Provision Azure Blob Storage (Hot tier, LRS or GRS)
Enable time-based immutability policy (minimum 14 days, recommended 30)
Configure Veeam or Acronis to write backups to Blob via Scale-out Backup Repository (SOBR) with cloud tier

Option B: Veeam Cloud Connect (Technica-managed, ₱0.80/GB/month)

Provision cloud repository quota with Technica (Singapore region)
Import Veeam Cloud Connect credentials in Veeam console
Create backup copy job—replicate to cloud repo nightly

Option C: LTO-9 Tape (₱350K upfront, ₱4,500/tape)

Purchase LTO-9 tape drive + initial tape set (7 tapes = weekly rotation)
Configure Veeam or Acronis tape job (weekly full backup)
Establish offsite rotation procedure (transport to branch office or secure storage)

Step 3: Implement Automated Restore Testing (Week 3–4)

If you use Veeam:

Enable SureBackup—automated recovery verification that boots VMs in an isolated Virtual Lab, runs application health checks, and generates pass/fail reports.

If you use Acronis:

Use Acronis Instant Restore—spins up a VM from the backup repository, verify it boots, then discard or migrate to production.

Manual alternative:

Quarterly calendar reminder—restore one VM, one database, one file share to a test environment. Document the restore time (RTO) and data age (RPO).

Step 4: Document Your DR Plan (Week 4)

Required sections (per BSP Circular 1082):

Backup schedule: Daily incremental, weekly full, monthly tape rotation
Retention policy: 30 days local, 90 days cloud, 12 months tape
Recovery objectives: RPO ≤24 hours, RTO ≤4 hours (adjust per business criticality)
Immutable copy location: Azure Blob (Singapore), retention 30 days
Last restore test: Date, system tested, result (pass/fail), issues encountered
Contact list: Backup admin, IT head, Technica support (if managed service)

Store this document in two places: SharePoint/Google Drive (accessible from anywhere) + printed copy in DR binder (survives total IT outage).

Cost Examples: 3-2-1-1-0 for Philippine SMEs

Example 1: 10-Person Office (500GB Data)

Copy	Location	Media	Immutable?	Cost/Month
1 (prod)	On-prem server	SSD	No	₱0 (existing)
2 (local)	Synology NAS	HDD	No	₱0 (existing)
3 (offsite)	Azure Blob (Singapore)	Cloud	Yes (30-day retention)	₱450
Total				₱450/month

Restore testing: Veeam SureBackup (automated, included in Essentials license)

Example 2: 50-Person Office (5TB Data)

Copy	Location	Media	Immutable?	Cost/Month
1 (prod)	On-prem VMs	SSD	No	₱0 (existing)
2 (local)	QNAP NAS	HDD	No	₱0 (existing)
3 (offsite)	Veeam Cloud Connect (Technica)	Cloud	Yes (hardened repo)	₱4,000
Total				₱4,000/month

Restore testing: Veeam SureBackup weekly (automated)

Example 3: 100-Person Enterprise (20TB Data)

Copy	Location	Media	Immutable?	Cost/Month
1 (prod)	On-prem VMs	NVMe	No	₱0 (existing)
2 (local)	NetApp NAS	HDD	No	₱0 (existing)
3 (cloud)	Azure Blob GRS (Singapore)	Cloud	Yes (90-day retention)	₱18,000
4 (tape)	LTO-9, rotated offsite weekly	Tape	Yes (WORM)	₱1,500 (tapes only)
Total				₱19,500/month

Restore testing: Quarterly DR drill (manual), Veeam SureBackup monthly (automated)

Regulatory Requirements for Philippine Businesses

BSP Circular 1082 (Banks, Payment Service Providers)

Section 4.3.4 (Business Continuity Management):

Offsite backup storage required
Annual DR testing mandatory
Recovery objectives (RPO/RTO) must be documented

3-2-1-1-0 satisfies this. The +1 immutable copy protects against ransomware targeting backup infrastructure. The +0 testing requirement exceeds BSP's annual drill mandate.

NPC Circular 16-01 (Data Privacy for Government)

Section 6 (Security of Personal Data):

Implement appropriate organizational and technical measures to protect personal data
Maintain copies of personal data for disaster recovery

3-2-1-1-0 aligns with "appropriate technical measures" for personal data breach prevention. Immutable backups ensure personal data can be recovered even if production is encrypted.

BIR Revenue Regulations 29-2013 (Electronic Recordkeeping)

Section 4 (Safekeeping of Electronic Books of Accounts):

Maintain backup copies of accounting records
Ensure data integrity and retrievability for audit purposes

3-2-1-1-0 ensures BIR records are recoverable. The +0 restore testing verifies that you can actually produce ledgers, invoices, and receipts if BIR requests them during audit.

What Technica Recommends

For offices <50 people:

Veeam Essentials or Acronis Cyber Protect Standard (workstation licensing)
Local backup to Synology/QNAP NAS
Offsite immutable copy to Azure Blob Storage (₱0.90/GB/month, 30-day retention)
Automated testing with Veeam SureBackup or manual quarterly DR drill

For offices 50–200 people:

Veeam Backup & Replication (VUL licensing)
Local backup to enterprise NAS (NetApp, QNAP)
Offsite immutable copy to Veeam Cloud Connect (Technica-managed, Singapore region)
Weekly SureBackup, quarterly full DR drill

For enterprises >200 people or regulated industries:

Veeam or Acronis Advanced tier
Local NAS + Azure Blob GRS (immutable, geo-replicated)
LTO-9 tape for long-term retention (monthly rotation, 12-month retention)
Monthly SureBackup, quarterly DR drill documented for BSP audit

Next Steps

Is your current backup 3-2-1-1-0 compliant? Technica audits your disaster recovery plan, tests your restores, and designs a backup architecture that meets BSP/NPC requirements.

Talk to our Cloud & I.T. team →

Related Articles:

Sources: