Backups & recovery: what to consider before designing
Backup isn't the goal — it is predictable recovery. This list helps set expectations, risks, and decisions before the draft.
A running backup job does not guarantee successful recovery. It is critical to define RPO/RTO,
regularly tested recovery and separate access for recovery (even with ransomware).
The minimum standard is a clear owner, recovery runbook and measurable recovery time for top services.
Key questions
- RPO/RTO: what is the data loss tolerance (RPO) and what is the recovery time accepted (RTO) for critical services?
- Scope: are you backing up only data, or also configurations, keys, secrets and infrastructure state (e.g. IaC)?
- Access: where are recovery credentials stored, and are they separated from regular accounts (least privilege, break-glass)?
- Testing: are there regular recovery tests and do you have the results (success, recovery time, findings)?
- Major incident: what is the procedure in case of ransomware or widespread failure (eg site/region outage)?
Security and operations
A good backup design also addresses security: separate access rights, auditability and protection against changes (immutability/retention lock) and clear recovery runbooks. The goal is to make recovery manageable even in a stressful situation.