An untested backup is a hypothesis
Many companies believe they are protected because backup software runs every night. On the day of a ransomware attack, some discover that their backups are incomplete, encrypted too, too old or impossible to restore quickly.
What the 2025 and 2026 figures reveal about restores
Industry statistics give a precise measure of the gap between having a backup and actually being able to use it, and that gap is wider than generally imagined:
Companies hit by ransomware over 12 months (CrowdStrike 2025): 78%.
Organisations unable to restore all their data after an attack: 39%.
Average cost of business interruption per incident: 1.7 million dollars.
The most telling figure is the second: having a backup is not the same as being able to restore. Nearly four organisations in ten that thought they were protected discovered, at the worst possible moment, that they could not recover all of their data.
The 3-2-1-1-0 rule sums up a good direction: several copies, several media, one copy off site, one isolated or immutable copy, and zero errors during verification. But the rule is not enough if it is never put to the test. The decisive question remains: have you ever restored?
The points to check
Scope: servers, files, databases, virtual machines, Microsoft 365, network configurations.
Frequency: does the interval between two backups match the acceptable data loss?
Isolation: are backups protected from a compromised administrator account? Attackers now actively target the backups themselves, which explains a good share of the restore failures observed after an incident.
Immutability or offline copy: can one copy withstand ransomware?
Tests: are restores carried out regularly?
Recovery time: how long does it take to get the service running again?
Responsibilities: who decides, who restores, who communicates?
RTO and RPO: the two figures to know
The RPO indicates how much data the business accepts to lose. With a daily backup, the RPO can reach 24 hours.
The RTO indicates the acceptable time before the service is back. Restoring several terabytes of data onto unprepared hardware can take far longer than expected, a factor that weighs directly on the average business interruption cost of 1.7 million dollars measured per incident.
Without these two figures, there is no way of knowing whether the backup truly meets the business need.
Decoding the rule figure by figure
Each figure in the 3-2-1-1-0 rule answers a specific failure mode, which helps explain why none is superfluous:
3 copies: the original plus two copies. A single copy never survives a hardware failure occurring at the same time as an attack.
2 different media: disk and cloud, for example, never two identical disks of the same model likely to fail for the same reason at the same time.
1 off-site copy: geographically separate, to survive a physical disaster (fire, flood, theft) affecting the main site.
1 isolated or immutable copy: disconnected from the network or made unmodifiable for a defined period, the only real protection against ransomware that actively encrypts or deletes backups reachable from the compromised network.
0 errors: zero anomalies found during backup checks and restore tests, the only figure in the rule that cannot be configured technically but must be proven by a real test.
The restore test
A simple test beats a theoretical promise. Choose a critical server, database or folder. Restore it into an isolated environment. Check permissions, file integrity, application consistency and the real time required.
Then document the gaps: backup too slow, forgotten dependency, missing password, unwritten procedure, insufficient space. Each test makes the business more robust, and lowers the odds of joining the 39% of organisations that discover too late that they cannot fully restore their data. A test that fails in a controlled environment, without pressure or urgency, is good news: it reveals a fixable problem before a real incident turns it into a crisis.
Backup is a matter for management
Backup is not just an IT tool. It protects revenue, reputation and business continuity, with an incident cost that easily runs into tens or even hundreds of thousands of euros for a small business. Management must understand it, budget for it and have it tested.
The cloud is not a backup in itself
A persistent belief holds that data in the cloud is safe by nature. It is not. A backup hosted in the cloud but permanently connected to the network remains reachable from that network, and therefore by anyone who compromises its credentials. If an attacker obtains sufficient administrative rights, they can reach these backups just as they would a local disk, and encrypt or delete them before triggering their ransomware. The cloud moves the data; it does not isolate it automatically.
What protects is not the location but two specific properties: immutability, which makes a copy unmodifiable for a defined period, and isolation, which disconnects it physically or logically from the network. An immutable cloud backup is excellent protection; a simple sync to the cloud, continuously connected, is not. The distinction is technical, but it makes all the difference on the day of an attack.
Who does what on the day of the incident
Restoring is not only a technical matter, it is also a question of organisation, and that is often where everything is decided. On the day of a ransomware attack, under stress, a team that has never defined roles loses precious time wondering who decides to isolate systems, who starts the restore, who informs customers and management, who contacts the insurer or the authorities. That lost time is paid for directly in hours of downtime.
A clear plan, written and known in advance, changes everything. It does not need to be a thick document: a few pages are enough to allocate responsibilities, list emergency contacts and describe the order of operations. What matters is that it exists before the incident, not that it is improvised during it. A restore test is also the ideal opportunity to check that the plan holds up.
Restoring, the only proof that counts
Everything in a backup strategy comes down to a single question: have you ever restored? The 3-2-1-1-0 rule lays good foundations, but it is only worth something if a real test confirms it, ideally several times a year and on a representative scope. A test that fails in the calm of a controlled environment is an opportunity: it reveals a fixable flaw before a real incident turns it into a disaster.
To go further, read our guides on the IT audit and on disaster recovery and business continuity for small businesses. It is better to discover the limits of your backups during a test than on the day of an attack.
Sources: Solutions Numériques, Ransomware 2025: 78% of companies hit according to CrowdStrike · CrowdStrike, 2025 Ransomware Report · NIST SP 800-34 Rev. 1, Contingency Planning Guide