Ransomware-resistant backup for Indian SMEs: 3-2-1 copies, immutable storage, air-gapped copies, and the six restore drills that prove recovery.
Ransomware-resistant backup means keeping at least one copy the attacker cannot reach or delete, and proving you can restore from it. India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), and Indian SMB ransomware detections rose from 3.18% to 4.07% in a year, so backup design is now an operational question. The baseline is three copies on two media types, one copy offline or immutable, 180 days of log retention under CERT-In directions, and a restore tested quarterly.
Immutability and separation, in that order. A backup that sits on the same network, under the same administrator credentials and inside the same ransomware-visible file share is not a backup, it is a second copy of the problem. Ransomware operators routinely enumerate network shares and volume snapshots, and the 2026 groups operating out of APAC, where India is the second most ransomware-hit country, have been seen deleting snapshots during encryption to force payment. A genuinely resistant design keeps one copy on immutable or write-once storage, one copy on a separate media type such as tape or removable media, and one copy offline in a different physical location. The three are not redundant: the immutable copy survives a credential compromise, and the offline copy survives a compromise of the backup platform itself.
Retention has two masters: operational and legal. Operationally you need enough history to survive the discovery delay, and ransomware dwell time before encryption is often measured in weeks, so a 30-day window is thin. Legally, CERT-In directions require 180 days of log retention, and that is a floor for anything you will need to reconstruct an incident. For a business that wants to demonstrate the chain of custody after a data breach, retain 12 months of immutable backups. One common Indian pattern worth copying is tiered retention: daily for 30 days, weekly for 12 weeks, monthly for 12 months, on immutable storage with a separate credential set.
One full restore of a production workload, at least quarterly, measured in hours rather than rehearsed in a slide deck. A drill should cover a file-level restore, a database point-in-time restore, a bare-metal or virtual machine rebuild from the newest clean image, and a full identity rebuild because the Active Directory or identity provider is itself backed up and frequently restores badly. Record the time to first restored service and the time to full recovery, then compare it against the recovery targets in your incident response plan. India's 21,900 digital-arrest complaints involving over Rs 647 crore in the first eight months of 2026 show how fast a financial-fraud pattern becomes a multi-agency coordination problem, and recovery speed is what determines whether a compromise stays an IT incident or becomes a reportable event.
Enough that a single ransomware event does not end the business, which for a Kerala SME typically means a managed offsite backup subscription rather than a capital project. At AAVETech the work starts with a backup and recovery readiness assessment: we review what is copied, where it lives, who can delete it, how quickly it can be restored, and what it would cost to recover. It is a fixed-price engagement at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with the retest included, and it produces a written restore procedure your team can actually follow at 2 a.m.
| Layer | Control | Retention | Purpose |
|---|---|---|---|
| Local copy | Endpoint backup with local retention | 7-14 days | Fast recovery from device loss |
| Immutable copy | Write-once or object-lock storage | 12 months | Survives credential compromise |
| Offline copy | Tape or removable media off-network | 12 months | Survives backup platform compromise |
| Logs | Central SIEM copy per CERT-In | 180 days minimum | Reconstruct the incident |
| Restore proof | Quarterly documented drill | Permanent record | Prove recovery, not assume it |
Ransomware-resistant backup means keeping at least one copy the attacker cannot reach or delete, and proving you can restore from it. India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), and Indian SMB ransomware detections rose from 3.18% to 4.07% in a year, so backup design is now an operational question. The baseline is three copies on two media types, one copy offline or immutable, 180 days of log retention under CERT-In directions, and a restore tested quarterly.
Three copies, on two media types, with one copy offline or on immutable storage. The third copy is not paranoia: ransomware operators routinely delete snapshots and network shares during encryption, so a backup reachable from the same domain administrator account provides no protection at all.
CERT-In directions require 180 days of log retention, which is a floor for anything you will need to reconstruct an incident. Most businesses that want to demonstrate chain of custody retain 12 months of immutable backups on tiered daily, weekly and monthly schedules.
At least quarterly, and the drill should cover a file restore, a database point-in-time restore, a rebuild from a clean image and a full identity provider rebuild. Record the time to first restored service so the number can be compared against the recovery target in your incident response plan.
Usually not. Cloud backup helps with device loss and accidental deletion, but if the same credentials can delete the backup, it does not help against ransomware. A second copy on offline or immutable storage, with a separate credential set, closes that gap.
At AAVETech a backup and recovery readiness assessment is fixed-price, at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and a retest included. The output is a written restore procedure, not a slide deck.
Read the full guide on AAVETech: How Do You Make Your Backups Ransomware-Resistant?.
Book a backup and recovery readiness review and we will return a written scope, a fixed price, and the restore procedure your team can follow at 2 a.m.
Talk to an analyst about this.