# Immutable anti-ransomware backup for SMEs Immutable backup has become the anti-ransomware barrier for SMEs in PACA: a copy that even a compromised administrator cannot erase during the retention period. In Nice, Cannes, Monaco, or Tourrettes-sur-Loup, Host Technology sets the 3-2-1 rule with retention lock / Object Lock, restore tests, and job monitoring — not a single NAS on the same VLAN as production. ## Why immutability changes the outcome Modern ransomware looks for backups: admin credentials, open shares, a badly configured cloud. An immutable copy stays readable for restore, not for deletion. Without it, paying or rebuilding are often the only options. Operational cybersecurity starts here. Host Technology reminds clients that no backup excuses the absence of MFA and hardening: immutability reduces the impact; it does not by itself reduce the probability of intrusion. ## Restating the 3-2-1 rule Three copies, two media types, one off site. Immutability ideally applies to the remote copy (object vault, logically air-gapped appliance). The local copy speeds the RTO for a lost file; the immutable copy saves the day of mass encryption. The local copy can stay “fast” without being immutable; the remote copy carries the retention lock. This split of roles optimizes cost and RTO. ## RPO, RTO, and critical businesses Set the acceptable data loss and the return time for accounting, the hotel PMS, files, and email. Host Technology turns these figures into job frequency and infrastructure choice (FTTH/FTTO fiber for the overnight window). On FTTH, spread the jobs or move up to FTTO for a time if volumes explode (large file shares, medical images, PMS). Host recalculates every year. ## Microsoft 365 and SaaS The native recycle bin is not enough against a mass deletion or a hijacked admin account. A third-party backup of Exchange / OneDrive / SharePoint completes the foundation. Many SMEs on the Côte d'Azur forget it until the first incident. Test a full Microsoft 365 restore of a witness mailbox: it takes longer than a file folder, and the real RTO often surprises. ## Network and telephony configs Firewall, IPBX, numbering plan, switches: without a config backup, the RTO explodes. Host includes these items in the SME backup policy, alongside files and servers. A bad firewall restore can cut VoIP: a test scenario with mandatory 4G backup. ## Immutable anti-ransomware backup checklist - Map critical data plus configs (network, telephony, Microsoft 365). - Define RPO/RTO per application. - Deploy a local copy plus a remote copy with immutability (retention lock). - Separate backup accounts; MFA mandatory. - Encrypt in transit and at rest. - Monitor every job (failure alert). - Test a business restore every quarter; time it. - Document recovery for managed IT / a third party. The checklist is also a cyber-insurance tool: more and more questionnaires ask for immutability and test frequency. Host prepares the evidence. ## Tests: the only proof Restore a folder, a VM, a test mailbox. Note the time. A backup that has never been restored is a hypothesis. Host managed-IT contracts include this rhythm to avoid a bad surprise. Archive the reports with measured duration and restored volume. Without figures, the test convinces no one. ## Link with the disaster-recovery plan and telecom backup Immutable backup feeds the data disaster-recovery plan. 4G/5G backup and IP telephony cover voice continuity during the incident. Host Technology assembles the three: data, network, switchboard. In a ransomware incident, telephony continuity (reception, crisis communications) stays vital while restore is under way. The disaster-recovery plan couples the two. ## Mistakes to avoid - Backup on the same NAS as the production shares. - The same Domain Admin account for everything. - Immutability disabled “to make room.” - No alert on failed jobs. - A backup window that saturates VoIP during the day. In practical terms, every PACA site has its own constraints (building, seasonality, multi-site setups across Monaco and Nice): Host Technology adapts the action plan rather than copying a fixed national template, with a single point of contact for the network, telephony, backup, and managed IT. The documentation delivered at the end of the project (diagrams, accounts, failover procedures, operator contacts) is designed so a third party can take it over: that is a Host requirement, not an optional extra. It reduces dependence on a single person and speeds up later audits. Finally, plan a review at 30 and 90 days: recurring tickets, QoS or throughput measurements, restore tests, and additional training. That is often when supervision thresholds are adjusted and management sees the operational gain on the Côte d'Azur. Before closing a backup project, Host Technology restores a set of business data and a network/telephony config under real conditions: that is the only way to prove that immutability and the 3-2-1 rule hold on your Côte d'Azur site, not only on paper. Fixing these five mistakes is often enough to turn a “cosmetic” backup into a real barrier for a PACA SME. - Isolate backup identities from the production directory. - Forbid deletion before the retention deadline, including for administrators. - Keep an off-site copy on separate infrastructure. - Watch failures, abnormal volumes, and the sudden disappearance of sources. - Test files, VMs, Microsoft 365, and network configurations. - Document real duration, dependencies, and restore order. Immutability must be governed with as much care as production. Retention that is too short does not cover a silent intrusion; an excessive duration raises costs and can complicate deletion obligations. Host Technology helps the SME classify data, define daily, monthly, and yearly cycles, then protect the accounts that administer the vault. Alerts are sent to a person different from the job operator. This separation of roles makes it harder to erase data and evidence at the same time during ransomware. The restore scenario must provide a clean environment. Putting healthy data back onto a directory that is still compromised can restart the attack. The disaster-recovery plan therefore defines the order: contain, preserve evidence, rebuild essential identities and equipment, then restore applications by priority. Host Technology coordinates network, IP telephony, and backup to keep a crisis channel during this phase. Keys, licenses, emergency passwords, and procedures are kept in a separate location, accessible to authorized people even if the main IT system is unavailable. An annual exercise finally checks that this emergency vault stays readable, complete, and known to the deputies designated by management. ## FAQ: frequently asked questions ### What is a backup that is truly immutable? It is a copy that cannot be modified or deleted before a set period expires, even with an ordinary administrator account. A simple read-only folder or a NAS disconnected from time to time does not offer the same guarantee. Object Lock or retention lock mechanisms must be enabled in a suitable mode and protected by separate identities. Host Technology checks the configuration, the rights, and the duration, then performs a restore to show that the data is both protected and usable. ### Is the 3-2-1 rule enough against ransomware? It sharply reduces the risk if the three copies do not share the same accounts and if one is off site and immutable. Three copies reachable by the same compromised administrator can be encrypted or deleted together. Segmentation, MFA, dedicated accounts, encryption, monitoring, and tests must therefore be combined. Host Technology completes the 3-2-1 rule with a dependency analysis: directory, hypervisor, firewall, IPBX, and the keys required for restore. The goal is to rebuild for real, not only to keep files. ### How do you define a good RPO and a good RTO? The RPO expresses how much data the business accepts losing; the RTO sets the target return time. These objectives are defined per application with management. Accounting may tolerate a few hours of loss but not several days of stoppage, while a hotel PMS sometimes requires more. Host Technology turns these expectations into backup frequency, FTTO or FTTH bandwidth, storage, and recovery order, then times the tests to confront the promise with the result. ### Does Microsoft 365 need a separate backup? Yes when the company wants retention, search, and restore independent of the native mechanisms. The recycle bin and Microsoft 365 retention answer some incidents, but not every scenario of deletion, a compromised account, or a historical need. A third-party solution protects Exchange, OneDrive, SharePoint, and possibly Teams with distinct identities. Host Technology includes this data in the disaster-recovery plan, tests a mailbox and a document space, then measures the time needed to return them. ### How often should restores be tested? A quarterly test of critical items is a solid baseline, completed by more frequent checks on files and by a wider annual recovery exercise. The objects must vary: VM, database, mailbox, firewall configuration, and IP telephony plan. Each test states volume, duration, errors, and corrective actions. Host Technology keeps these reports in managed IT. They prove that immutable backup stands up to ransomware and that the announced RTO/RPO stays realistic for the SME. Would your backup survive ransomware? Contact Host Technology for an immutability / 3-2-1 audit on the Côte d'Azur or in Monaco — repository, tests, and monitoring.