Backup

Backup design starts from two numbers agreed with the business: the recovery point objective (RPO, how much data loss in time is tolerable) and the recovery time objective (RTO, how long restoration may take). RPO drives backup frequency and technique - nightly full or incremental jobs, continuous journaling, database transaction-log shipping - while RTO drives the restore path: instant VM recovery from a backup repository, bare-metal restore, or rebuilding from infrastructure-as-code and then restoring data. Classic job types are full, incremental (changes since the last backup of any kind) and differential (changes since the last full); modern systems create "synthetic fulls" by merging increments on the repository and use block-level change tracking and deduplication to keep windows short.

The 3-2-1 rule - three copies, on two different media, one off-site - is often extended to 3-2-1-1-0: one copy offline, air-gapped or immutable, and zero errors in verified restores. Immutability is now the main ransomware defence, because modern ransomware operators deliberately locate and delete backup catalogues, shadow copies and repository credentials before encrypting. Implementations include object storage with WORM retention (for example S3 Object Lock in compliance mode, which even the root account cannot shorten), hardened Linux repositories with immutable file flags, tape rotated off-site, and backup systems in a separate administrative domain with their own MFA-protected credentials. Snapshots on the same storage array, RAID and synchronous replication are not backups: they faithfully replicate deletion, corruption and encryption.

Consistency matters as much as existence. A crash-consistent image of a running database may not start; application-consistent backups quiesce writes (on Windows via VSS writers) or use the database's own dump or log mechanism. SaaS data is a frequent gap - under the shared-responsibility model, providers such as Microsoft 365 guarantee service availability but offer limited retention of user-deleted or maliciously altered data.

Normative anchors: CIS Controls v8 Control 11 (Data Recovery), including an isolated instance of recovery data (Safeguard 11.4) and restore tests of a sample of assets at least quarterly (11.5); ISO/IEC 27002:2022 control 8.13 (information backup); NIS2 Art. 21(2)(c), which lists backup management alongside business continuity and disaster recovery; and GDPR Art. 32(1)(c), the ability to restore availability and access to personal data in a timely manner. Retention also has a data-protection side: backups containing personal data are subject to storage limitation, and erasure requests are usually handled by documented expiry rather than editing old backup sets. The only real evidence a backup works is a timed, documented restore.