The 3-2-1 Backup Rule and Restore Drills

The 3-2-1 rule

• 3 copies: 1 production + 2 backups;
• 2 media: not all on one disk or one cloud;
• 1 offsite / offline: against ransomware and datacenter failure.

RPO and RTO

RPO (recovery point objective) = how much data loss you tolerate; RTO (recovery time objective) = how long downtime you tolerate. They decide backup frequency and recovery design, align with the business first.

Verify backups

Hash the backup when written and hash again on restore to confirm no corruption. Keep encryption keys separate from the backup, or the backup is unreadable.

Most common backup failures

1. Backup but never restore: the first real restore happens in a crisis and then it doesn't work;
2. No monitoring: days of silent failures mean you weren't backed up at all;
3. Same-source backup: backup and live data in one account/cloud, deleted together by ransomware.

Restore drills

Do a real restore periodically (even one file), record the time, and push RTO down to an acceptable range. See Verifying file integrity with SHA-256.

Try it

Hash your backup files: File hash.

Tiering your backup strategy

Different data has very different recovery needs, and one policy for everything satisfies nobody.

1. Tier by recovery objective: core transactional data may need minute-level RPO, logs and analytics tolerate days, archives only quarterly. One frequency for all is both expensive and unnecessary.
2. Full plus incremental: take a periodic full backup with incremental or differential in between to control cost while keeping restore steps short.
3. Isolate backup credentials: the backup system should not share production credentials, and production should not be able to delete backups. Ransomware deletes backups before encrypting, so isolation is the last defence.
4. Verify automatically: after each run, check readability, plausible size and checksum, and feed the result into monitoring, unreadable files stored for months are worthless.
5. Write executable restore docs: include exact commands, ordering and required credentials rather than "restore from backup". Nobody wants to read something vague during an outage.

Running the drill

Set a clear target: how fast and to what state counts as success. Include someone unfamiliar with the system, because the original owner may not be on call. Record blockers and track follow-ups, or the next drill hits the same walls.

Cloud-specific cautions

In the cloud, snapshots and backups are often enabled by default and never verified. Confirm whether they cross availability zones or regions, whether deletion protection is on, and whether a compromised account could delete them too. Add these to routine checks rather than regretting later.