The best ways to back up your company's data

Data loss, whatever the amount, can make a service or an entire platform unusable, penalise every user, and even drive your company out of business.

The 3-2-1 rule remains the foundation of a sound backup strategy: three copies of the data, on two different media, one of them off-site. It protects against hardware failure, human error and physical disaster alike. Ransomware has added a requirement: at least one immutable or offline copy that a compromised account cannot delete.

Two indicators drive the technical choices. The RPO (Recovery Point Objective) defines how much data the business can afford to lose, and therefore how often backups run. The RTO (Recovery Time Objective) defines the acceptable time to restore service, and therefore the kind of recovery to prepare. A fifteen-minute RPO requires continuous replication, where a daily backup would be enough elsewhere.

Database backups deserve special treatment: a disk snapshot taken during a write can produce an inconsistent copy. Regular logical backups, combined with continuous archiving of transaction logs, make point-in-time recovery possible.

A backup that has never been restored is not a backup. A scheduled, timed and documented restore test is the only way to check that scripts, encryption keys and procedures are still valid on the day of the incident.