Reliable backups start from which data and services the company needs to restore, how much data it can afford to lose (RPO, Recovery Point Objective) and how long a restore may take (RTO, Recovery Time Objective). These requirements determine the frequency, retention, location of copies and who is responsible for checking them. A proven guideline is the 3-2-1 rule: at least three copies of the data, on two different types of storage, with one copy outside the main environment. At least one copy should be separated from everyday administrator accounts and from the system it protects, so that the same mistake or attack cannot delete it. For databases and virtual servers, consistency, encryption, keys and the required capacity must be addressed. Every job is monitored, but a green status is not yet proof that data can be restored. That is why a selected file, database or entire system is regularly restored into an isolated environment, and both the result and the actual time taken are recorded.
What to consider when deciding
The right solution differs for working documents, a database, a virtual server and a cloud service. The first step is to identify the data owner and the scenarios: a deleted file, a disk failure, a compromised account or the loss of an entire site. Only then can storage and licences be compared. When taking over existing backups, the configuration is not changed blindly; the latest runs, the availability of keys and a test restore are verified first. The outcome should be a concise disaster recovery procedure (Disaster Recovery Plan) that can be used even under stress and that ties into wider business continuity (Business Continuity) - how to verify that restoring from backups actually works is covered in a separate guide.