Backup Best Practices for Reliable Recovery

Backup best practices come down to five decisions, made in order: what to protect, how many copies to keep and where, who can reach them, how long to keep them, and who owns the result. The 3-2-1 backup rule is a starting point for the second decision, but this guide treats it as guidance, not law. It traces the rule to its source before using it. RTO (recovery time objective) is how long the business can wait for a system. RPO (recovery point objective) is how much recent data it can afford to lose. A copy is offsite when it sits outside the facility that holds the original. Step 2 covers whether a separate cloud account counts.

This guide is for an IT manager or IT head in India or the GCC. If your backups already run, each step gives you one question to ask of your own setup. The five-step order is our own, but the 3-2-1 wording and the ransomware advice come from US guidance. Each source carries a label where it appears.

Backup Best Practices in Short: Five Steps in Order

These backup best practices run in a deliberate order. If you change the order, later steps lose the target they answer to.

In Signisys’ view, the order follows what each step depends on, and targets come first because every later step answers to them. The list suits a firm of roughly 250 to 2,000 people with servers, cloud workloads and SaaS data. It orders the work and scores nothing. A separate Signisys article explains why backups fail without anyone noticing, while this one stays on the practices.

Backup Best Practices, Step 1: Decide What to Protect and How Much Loss Is Acceptable

Agree two numbers with the business before you choose any product: the RTO and the RPO. The RPO sets the gap between copies: if the business can lose one hour of data, a nightly copy does not meet that target.

Backup best practices then turn on that gap. CISA’s #StopRansomware Guide, drawing on operational insight from MS-ISAC, the NSA and the FBI, names no interval. It tells readers to back up data frequently. This article names none either, because the right gap depends on each system’s RPO. When the business agrees the targets, the owner of each system signs them off, not IT alone.

Before you pick tools, list every server, cloud workload and SaaS tool that holds business data, with an owner beside each. Put it as a question: which system would stop the business first if it went down?

When a restore starts, the order matters. The same CISA guide describes restoring from offline, encrypted backups based on a prioritization of critical services. Put that order on paper instead of leaving it in someone’s memory. If you want to score the plan and its targets, see our data recovery plan checklist.

Backup Best Practices, Step 2: Follow the 3-2-1 Backup Rule as Guidance, Not Law

Where the 3-2-1 Backup Rule Comes From

The rule appears in Data Backup Options, a paper by Paul Ruggiero and Matthew Heckathorn, copyright 2012 Carnegie Mellon University and produced for US-CERT. It dates from 2012, and its advice covers home users, small businesses and large organisations, with storage media such as floppy and ZIP disks in its list. Treat it as a starting point rather than a current standard.

The paper says to keep three copies of any important file, including one primary and two backups, on two different media types to protect against different hazards. It also says to store one copy offsite, for example outside the home or business facility. A footnote to the rule cites Peter Krogh’s 2009 book, The DAM Book. For large businesses or organisations, the paper says to consider one backup copy onsite and another offsite.

What 3-2-1 Means for Servers, Cloud and SaaS

Read the 3-2-1 backup rule as three questions, and use the table when you review your own setup.

In Signisys’ view, a second storage account or region may count as offsite for cloud data. The paper does not say so, but you can settle it with your team as a question.

Backup Best Practices, Step 3: Protect the Copies From Mistakes and Lost Keys

In Signisys’ view, a copy that a mistake or an attacker can reach is at risk. CISA’s guide says to maintain offline, encrypted backups of critical data. It explains that many ransomware variants attempt to find and delete or encrypt accessible backups.

Before you think about attackers, ask who could delete this copy by accident, or shorten how long the firm keeps it. For attacker reach, see checks 8 and 9 of our scored ransomware list and our guide to the backup copy that survives stolen admin rights.

Key handling belongs among backup best practices because an encrypted copy is only as recoverable as its key. Decide who holds each key, as well as where a second copy of it lives. A lost key leaves a complete copy unreadable.

Our piece on why backups fail silently tells the failure story. For encryption and access controls in general, read our wider guide to data security controls.

Backup Best Practices, Step 4: Set Retention and Cover Cloud and SaaS Data

Retention is how long you keep each copy. Keep versions long enough to return to a point before a problem began, and delete copies on a written rule.

Check whether data in cloud workloads and SaaS tools is covered by any backup at all. When you review the list from step 1, ask three questions of each system:

1. Which SaaS tools hold records that the business needs if the firm loses an account?
2. If a user deletes a record, what does the provider’s documentation say about restoring it, and for how long?
3. Does the SaaS copy count as a second copy under the 3-2-1 backup rule if it sits with the same provider?

Check each provider’s documentation and contract for the answers, because this article makes no claim about what any provider keeps. If a snapshot and a backup copy seem the same, see our comparison of the two copy types.

Backup Best Practices, Step 5: Name an Owner and Prove the Copies Restore

Backup best practices need a named owner and a restore that the team has tried.

A Named Owner and a Deputy

Name one person to own the backup report and what happens after it, with a deputy to cover absences. If a third party or MSP holds the backups, CISA’s guide says to ensure it follows the applicable best practices. Ask what the contract says about alerts and tests before you rely on it.

Prove It With a Restore

CISA’s guide says to test backup procedures on a regular basis. It also says to regularly test the availability and integrity of backups in a disaster recovery scenario. It gives no interval. In Signisys’ view, a copy nobody has restored is a guess.

This guide does not teach restore testing as a method. A separate Signisys article holds a scored list that includes restore tests, while another covers the criteria for choosing monitoring tools.

Backup Best Practices When Ransomware Is the Worry

Ransomware changes what must be out of reach, but it does not change the order of the five steps above.

Ask whether your offsite copy sits out of reach of the same login that runs production. That is the 3-2-1 backup rule asked as a security question, while the CISA line on offline, encrypted copies already applies.

Copy design sits in our guide to immutable backup. The scored checks on backups out of reach are checks 8 to 11 of our ransomware recovery checklist. For prevention before an attack, read our guide to stopping a ransomware attack. If you want the wider recovery picture, see the Signisys page on improving backup reliability and the data protection and cyber recovery solution.

Where These Backup Best Practices Stop, and When to Ask for Help

This guide holds no scored checklist, no tool comparison and no cause-by-cause walk-through of failures, although separate Signisys articles cover each. It gives no retention number and no testing interval, because CISA gives none.

The US-CERT paper dates from 2012 and CISA’s guide (September 2023 version) is US guidance. Your regulator, contracts and auditor decide what applies in India or the GCC. This guide gives no tailored advice if your firm has strict recovery needs.

Ask for help in these cases:

• The business does not agree its loss and wait targets.
• A provider holds the backups, but the contract is silent on who can delete them.
• The offsite copy sits under the same login as production, and nobody can move it.

Signisys provides data protection, backup and cyber recovery solutions, as well as cybersecurity services. Read this as a description of a Signisys service rather than neutral advice.

Backup Best Practices: FAQ