Hardware fails, people delete things by accident, and ransomware encrypts entire networks. Backups are your last line of defence – but only if they are done right.
The 3-2-1 rule
- 3 copies of your data (the original plus two backups)
- 2 different storage types (for example server disk and cloud storage)
- 1 copy off-site (in another location or data centre)
Many experts extend it to 3-2-1-1-0: one copy immutable or offline, and zero errors in restore tests.
Protecting against ransomware
Attackers try to delete or encrypt backups too. Protect them with:
- immutable storage (cannot be changed for a set period),
- separate credentials and multi-factor authentication,
- offline or air-gapped copies.
What to back up
- Databases and application data
- Files and documents
- Email and Microsoft 365 / Google Workspace data
- Server and application configurations
- Websites (files and database)
Retention
Keep daily backups for a few weeks, weekly for months and monthly for longer, depending on legal requirements (for example GoBD retention for business records).
Recovery objectives
- RPO (recovery point objective): how much data can you afford to lose? One day? One hour?
- RTO (recovery time objective): how quickly must systems be back?
These numbers determine backup frequency and technology.
Test restores
Schedule regular restore tests. A backup that has never been restored is an assumption, not a guarantee.
Document the plan
Who does what in an emergency, where backups are, how to restore – written down and accessible even if systems are offline.
All our hosting packages include daily backups, and we design backup strategies for business systems and cloud environments.