Backup strategy for SMEs: 3-2-1 rule, ransomware, M365

Why backups matter so much for SMEs

The current BSI situation report 2025 cites Federal Criminal Police Office figures for 2024: 950 ransomware attacks were reported to the police, slightly fewer than the year before. 72 percent of these reported cases involved data leaks or the threat of them, and around 80 percent of the attacks reported in 2024 targeted small and medium-sized businesses. The BSI sees attackers increasingly targeting weakly protected small and micro businesses, even for smaller ransoms. The BSI’s conclusion: backups remain essential against ransomware, but do not help against data leaks. Cyber insurers, the BSI adds, set security measures such as a suitable backup concept in their policy terms and check closely for omissions after a claim.

RPO and RTO: targets first, technology second

Every backup needs two target values from business continuity management. BSI Standard 200-4 defines them as follows:

• RPO (Recovery Point Objective), the maximum tolerable data loss: how old the available data may be so that emergency operation can sensibly continue. It sets the backup cycle: if you can lose at most one working day, you need at least daily backups.
• RTO (Recovery Time Objective), the required recovery time: the period from declaring the emergency to the required start of operations, for example until an IT system is reset to its last backed-up state.

The IT-Grundschutz module CON.3 (backup concept) requires these requirements to be gathered per IT system with the people responsible, from data volume to legal requirements. The resulting backup plans set out, among other things, the restore order, retention periods and protection against unauthorised access. Per the BSI, this includes routers, switches and other devices storing configurations.

Backup types: full, incremental, differential, snapshot, image

Software blurs the lines: the Proxmox Backup Server transfers only changes, yet per the vendor every backup references all data and so counts as full. And a RAID array is not a backup. The BSI explains why: mirrored data is changed simultaneously, so RAID protects against a failed disk, not against accidental overwriting or malware.

The 3-2-1 rule and the 3-2-1-1-0 extension

The best-known rule of thumb is 3-2-1. The BSI recommends it in a companion document to Standard 200-4: three current versions of important files, on two different media, in at least one other location. A 2012 paper by Carnegie Mellon University for US-CERT is more specific: the original and two backups, on two media types, one copy offsite. For the rule it refers to Peter Krogh’s book “The DAM Book” on digital asset management for photographers (2nd edition, 2009).

The backup vendor Veeam presents 3-2-1-1-0 as its own extension of the rule; it is a vendor term, not a standard, and does not appear in the BSI documents reviewed here. Veeam adds one immutable or air-gapped copy (the second 1) and zero errors on restore, proven by checks and testing (the 0). In substance this matches two BSI recommendations: at least one copy offline, and regular restore tests.

Offline and immutable: the copy attackers cannot reach

According to the BSI’s ransomware measures catalogue, attackers with stolen administrator rights search specifically for all backups and encrypt them too. So at least one copy should be offline, separated from other systems after the backup (an air gap): on separate tapes, in an archive that requires physical access, or in cloud storage completely separated from your own network.

• Test the separation: a domain administrator tries to reach the separated copies; per the BSI, this must fail.
• Limit write access: under CON.3, backups must be protected against overwriting; particularly sensitive media should only be connected during backup and restore.
• Separate physically: keep backup media apart from the systems they protect, ideally in a different fire compartment.
• Store immutably: existing backups cannot be altered afterwards. Microsoft 365 Backup uses append-only storage for this, the Proxmox Backup Server does not rewrite existing data blocks, and WORM tapes can be neither erased nor overwritten.
• Go back far enough: according to the BSI, attackers sometimes move around a network for weeks and may already be in the backup. Check for malware before any restore.

Encryption, with keys and credentials kept separately

A backup concentrates the company’s most valuable data. Where protection requirements are high, CON.3 recommends encrypting all backups and protecting the keys with their own, separate backup. The module gives the reason too: if the key is lost along with the data, the backup can no longer be restored.

• Keep keys separate: Proxmox recommends a password manager plus a USB stick in a secure place; the master key can be printed as a QR code. Encryption (AES-256-GCM) is off by default.
• Emergency documents on paper: keeping important documents, contacts and passwords in print may be necessary, the BSI says, so they remain available when systems are encrypted.
• Secure administrator accounts: privileged accounts for administration only and always with two-factor authentication, says the BSI, backup software included.

Test restores regularly

CON.3 makes testing a basic requirement: regularly check that backed-up data can be restored correctly and within an appropriate time. The BSI names no fixed interval; the Proxmox documentation recommends automated tests or at least random samples, for example weekly or monthly, always to a new VM rather than over the running one.

• Practise restoring single files and whole systems, not just a file from the recycle bin.
• Measure the time: does the actual duration fit the RTO?
• Have integrity checked: verification jobs compare checksums. Proxmox itself calls them an additional but not a sufficient protective measure.

Microsoft 365: who backs up your data?

Under Microsoft’s shared responsibility model, customer data, configurations and identities stay with the customer in every cloud model, Microsoft 365 included; Microsoft runs data centres, hardware and platform, and calls the model guidance, not a contract. Built-in recovery is limited:

For longer periods there is the paid Microsoft 365 Backup for SharePoint, OneDrive and Exchange, with a recovery window of 3, 6, 12 or 24 months. According to Microsoft the list price is 0.15 US dollars per GB of protected data per month, and restores are free (as of October 2026). The backups are immutable unless the backup administrator expressly deletes them through offboarding.

Retention policies and archives are not backups either. How Exchange Online relates to the German GoBD rules is covered in Exchange Online and the GoBD; how I plan and look after email archiving, under email archiving.

Virtualisation: backups with the Proxmox Backup Server

For Proxmox VE there is the open-source Proxmox Backup Server. According to its documentation (version 4.2) it offers, among other things:

• Incremental transfer, deduplication, SHA-256 checksums and scheduled verification jobs; client-side encryption and transfer via TLS.
• Synchronisation to a remote backup server; with the “remove vanished” option off, a compromised source server cannot delete anything on the target.
• Tape backup, including WORM tapes, as a second medium and for offsite storage.
• Fine-grained permissions: the Datastore.Backup privilege only allows creating backups; Proxmox recommends pruning on the backup server itself rather than giving hosts delete rights.

What the subscriptions cost is covered in the Proxmox versus VMware licence cost comparison. For the strategy, what counts is this: a backup server in the same room as the hosts is a copy in the same place. Only synchronisation to a second site or tapes stored elsewhere fulfil the 1 in 3-2-1.

Emergency plan: when every system is encrypted

For the worst case, all systems encrypted and a ransom demand on the table, the BSI recommends emergency planning that is practised regularly, hands-on too, up to a black start of all systems. According to the BSI, recovery can take weeks or months. The plan should cover:

• The business-critical systems and the order in which they are restored.
• Communication channels outside the affected network, phone numbers and contacts on paper, and a list of providers for recovery and forensics.
• Internal and external communication, including reporting obligations, and how to handle a ransom demand.
• The backup concept itself, backed up under CON.3 so that it remains available if the backup systems fail.

Tabletop discussions are a good start, but only a real rebuild shows whether the plan holds.

Legal framework: GDPR, retention, NIS2

Among its technical and organisational measures, Art. 32 GDPR names the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident (para. 1 point c) and a process for regularly testing the effectiveness of these measures (point d). A regularly tested backup is an obvious building block for meeting and demonstrating both.

For German tax purposes, as general guidance: retention periods under § 147(3) of the Fiscal Code (AO) are ten, eight or six years, and digital records must stay available and readable throughout. That is a job for archiving, which the BSI covers in its own module OPS.1.2.2, not in CON.3. For companies covered by NIS2, the German BSI Act names backup management and disaster recovery as a minimum measure (§ 30(2) sentence 2 no. 3 BSIG). Whether you are affected is covered in NIS2 for SMEs.

I have built IT infrastructures for companies, with networks, servers and backups, and look after them remotely. Continuous monitoring is covered in the article on RMM and managed IT; my services are listed under IT infrastructure.