Backups that survive ransomware: 3-2-1 for PR SMBs
Copying data to a NAS in the same office is not backup — it is false comfort. How to design restore that works when the domain falls.
After every ransomware wave Brian Krebs documents, SMBs ask the same thing: "did we have backup?" Yes — until they discover Veeam or the NAS was encrypted too because it shared credentials with the compromised domain.
The 3-2-1 rule remains sensible: three copies, two media, on
The 3-2-1 rule remains sensible: three copies, two media, one off-site immutable. For an accounting firm in Hato Rey or a Bayamón distributor, that can be local backup + S3 copy with Object Lock + weekly tested snapshot. You do not need tape; you need isolation and testing.
Test full restore, not just "the job went green
Test full restore, not just "the job went green." Simulate Active Directory loss, SQL restore, and real recovery time (RTO). If it takes 72 hours and your business tolerates 8, backup technically works but operationally fails. Document runbooks someone other than the original consultant can run.
Encryption in transit and at rest is mandatory; also rotate backup credentials separate from the domain. MFA on the cloud console where copies live. CISA publishes alerts when ransomware variants specifically hunt backup tools — treat them as critical assets, not forgotten utilities.
A decent program for 25–100 employees in Puerto Rico is usually a fraction of one incident. Negotiate with your insurance broker: many cyber policies require evidence of tested off-site backups. That is not paperwork; it is survival.
Operations and execution — connecting strategy with what the team ships every week.
