Five Backup Checks to Start 2026

Most organizations find out how good their backups are during an incident. A better time is now, before anything has gone wrong, with an hour set aside and five yes-or-no questions.

The questions come from the 3-2-1-1-0 rule: three copies of your data, on two different storage types, one copy offsite, one copy immutable or air-gapped, and zero errors in verified backups and tested restores. The classic 3-2-1 rule protected against hardware failure and disaster. Ransomware goes after backups too, so the rule grew two more numbers.

1. Do you keep at least three copies of your critical data?

Production plus at least two backups. With only one backup, a single failed job or corrupted copy can leave you with nothing.

2. Are those copies on at least two types of storage?

Disk and cloud, or disk and tape. One media failure, or one flaw in one vendor's storage, shouldn't be able to take every copy at once.

3. Is at least one copy offsite, far from your primary site?

Far enough that one storm, fire or regional outage can't reach both. Cloud storage in another region counts; a second rack in the same building doesn't.

4. Is at least one copy immutable or air-gapped?

This is the one ransomware cares about. An immutable copy can't be altered or deleted until its retention period ends, even by an administrator. An air-gapped copy is isolated from your network, logically or physically, so an attacker who owns your environment still can't reach it. Ideally you have both.

5. Have you tested a full restore in the last quarter?

The zero in 3-2-1-1-0 stands for zero errors: every backup completes cleanly, and you regularly restore from it. Backups fail quietly, with a job that skipped a server, a copy that won't mount or a restore that takes days instead of hours. A backup you haven't restored is a guess.

What to do with the answers

Each "no" is the next thing to fix, roughly in the order above. If you answered yes to all five, write down how long your last full restore took. That number is the start of your recovery time objective.

KELYN covers every part of the rule as one managed service: Datastor keeps Commvault backups in AWS alongside your on-premises copy, DAR Assured Recovery adds immutable, air-gapped copies with encryption keys you control, Spectra Logic tape adds an offline third medium, and Recovery Co-Pilot (RECO) tests restores with your team.

For the full checklist and a map of how copies are kept apart, read the 3-2-1-1-0 backup rule guide, or score your wider recovery readiness with the Cyber Readiness Scorecard.