Almost every business says it has backups. Far fewer have ever tried restoring one. The day you need a backup is the worst day to find out it is incomplete.
Follow the 3-2-1 rule
- 3 copies of your data
- on 2 different kinds of storage
- with 1 copy kept off-site
Decide what “recovered” means
Agree two numbers with your team: how much data you can afford to lose (for example, one hour) and how long you can afford to be down (for example, four hours). Your backup plan should meet both.
Test restores on a schedule
Restore a backup to a separate server every month and check that the application actually starts and the data is there. Write down how long it took.
Protect backups from the same problems as production
If an attacker or a mistake can delete your servers, it should not be able to delete your backups with the same password. Keep at least one copy that cannot be changed once written.