Backup and recovery

Also called Backups, 3-2-1 rule, RPO, RTO

Copies of your data you could actually restore from. The second half of that sentence is where most businesses fail.

What it means

A backup is a copy of data kept separately so it can be restored after loss. Recovery is the act of restoring it, and it is the part that is rarely tested.

Recovery point objective is how much data you can afford to lose, measured in time. Recovery time objective is how long you can afford to be down.

Why it matters

Backups are the last line against hardware failure, human error, ransomware and accidental deletion.

Cloud services are not automatically backed up in the sense people assume. Most retain deleted items for a limited period and then remove them permanently; that is not a backup.

What it looks like in practice

Decide your RPO and RTO first, then buy accordingly. "Nightly" means you can lose a day.

Follow 3-2-1, with at least one copy offline or immutable.

Test a real restore quarterly and time it. The test finds the missing thing — a database with no schema, a system nobody has the licence key for.

Include the things nobody thinks of: email, the website, the domain registrar login, the accounting data.

What to watch out for

Backups that have been silently failing for months. Monitor and alert on success, not on failure.

Retention shorter than your detection time. If a problem is found after 45 days and you keep 30 days, the backups are of the broken data.

Where to get proper advice

The NCSC's backup guidance for small organisations. Your IT provider should be able to state your current RPO and RTO — if they cannot, that is the finding.