The attributes behind your decision
- RPO
- Tolerable data loss
- RTO
- Tolerable recovery time
- Retention
- Historical versions kept
- Validation
- Successful restore test
Define recovery objectives
The recovery point objective describes tolerable data loss; the recovery time objective describes tolerable downtime. Use those requirements to set backup frequency, retention, and restore procedures. A daily backup cannot guarantee recovery of changes made after the last run.
Keep a copy outside the active server
Separate backup storage from the machine being protected and restrict deletion permissions. Encrypt sensitive backups and protect keys separately. RAID can help availability after some disk failures, but it is not a replacement for an independent backup.
Test restoration with the application
Restore into an isolated environment, verify records and file integrity, and check that the application starts correctly. Record the time required and missing dependencies. Repeat after material changes to the software or storage layout.