Backup That Works — Strategy, 3-2-1 and Recovery
RPO and RTO, storage separate from the system, and why an untested copy is worthless
Data is lost in many ways: a disk fails, a user accidentally deletes a folder, a ransomware attack encrypts everything, or an update corrupts a database. Backup — making a safety copy — is insurance against disaster. But unlike insurance you never have to think about, backups require maintenance, and most importantly: they must work when disaster strikes. Many only discover their backup is unusable the day they need it.
§3-2-1 rule
A widespread and easy to remember rule of thumb for robust backup is called 3-2-1: have at least three copies of your data on at least two different media types of which at least one is in another physical location (offsite). The thinking is to avoid a single point of failure: if all copies are on the same server or in the same building one event — fire, theft, ransomware — can take them all. A copy separated from the rest survives what hits production.
- 013 copies: original plus two backups
- 022 media types: so one media's failure doesn't affect all copies
- 031 offsite: one copy at a different physical location than production
- 04Consider a copy that cannot be changed or deleted — resistant to ransomware
§RPO and RTO — how much and how long
Two concepts govern how backup should be designed. RPO (Recovery Point Objective) is how much data you can accept to lose — measured in time back to last usable copy. Taking backup once a day means you could in worst case lose up to a day's work. RTO (Recovery Time Objective) is how long you can accept the system to be down while restoring. The lower the RPO and RTO, the more expensive and advanced a solution is required — so they are set based on how critical each system is, not uniform for everything
§Full, incremental and differential
You rarely take a full copy of everything each time — it takes space and time. Instead, types are combined. A full backup copies everything. An incremental backup copies only what has changed since the last backup — it's fast and small, but a restore requires the full backup plus all the incrementals in order. A differential backup copies everything changed since the last full backup — it takes more space than the incremental, but is simpler to restore from.
| Type | Copies | Recovery |
|---|---|---|
| Full | Everything, every time | Simplest — only the one copy |
| Incremental | Changes since last backup (regardless of type) | Full + all incremental in sequence |
| Differential | Changes since last full backup | Full + latest differential |
§Storage and lifetime
You don't keep all copies forever — it costs and goes against the principle of only keeping what is necessary. A retention plan determines how long each type of copy is kept: perhaps many daily backups in the recent past, fewer weekly further back, and occasional monthly ones as a long-term archive. Remember that backups also contain personal data — so GDPR's rules on deletion and security also apply to your backups.
§Backup is not the Same as Archive or Redundancy
It is easy to confuse three things. Redundancy (e.g. mirrored disks) protects against hardware failure, but not against a file being deleted — the deletion is mirrored immediately. A snapshot of a virtual machine is practical, but typically sits in the same place as the original and is not a real backup. An archive is long-term storage of data you rarely touch, not a copy for quick restoration. A well-thought-out operational reliability uses each of them for its own purpose — and a real, separate and tested backup is the backbone.
“No one wants backups. Everyone wants recovery. Always design backwards from the moment data needs to be restored.”
— Rule of thumb from IT operations.