Backup and Data Recovery Procedure
3-2-1 rule, schedule, encryption and recovery tests
1. 3-2-1 Rule and Basic Requirements
💾
3-2-1 Rule (minimum):
3 copies of data (1 production + 2 backup) | 2 different media/technologies | 1 copy off-site or offline (air-gap)
3 copies of data (1 production + 2 backup) | 2 different media/technologies | 1 copy off-site or offline (air-gap)
⚠ Critical – backups must be isolated from the production network
At least one backup copy must be offline or air-gapped – inaccessible from the production network. This prevents ransomware from encrypting backups. Organisation confirms implementation: ▸ [YES / NO – if NO, describe implementation plan]
2. Backup Schedule
| System / dataset | Data type | Frequency | Backup type | Retention | Location |
|---|---|---|---|---|---|
| ▸ [File server / NAS] | ▸ User data | ▸ [Daily]min. daily | ▸ [Full weekly + incremental daily] | ▸ [90 days]min. 30 days | ▸ [Location 1 + off-site Location 2] |
| ▸ [ERP / CRM database] | ▸ Business data | ▸ [Every 4h / daily]min. daily | ▸ [Full + transaction logs] | ▸ [1 year]min. per legal requirements | ▸ |
| ▸ [Domain controller / AD] | ▸ Configuration and identity | ▸ [Daily]min. daily | ▸ [Full] | ▸ [30 days]min. 30 days | ▸ |
| ▸ [OT/SCADA systems] | ▸ Configuration and process data | ▸ [After each change + weekly] | ▸ [Configuration + snapshot] | ▸ [min. 1 year] | ▸ [Offline/air-gap REQUIRED] |
| ▸ [Virtual machines] | ▸ VM snapshots | ▸ [Daily]min. daily | ▸ [Snapshot / full weekly] | ▸ [30 days] | ▸ |
3. Technical Requirements
| Requirement | Standard | Implementation in organisation |
|---|---|---|
| Backup encryption | ABSOLUTELY REQUIRED | ▸ [tool + algorithm, e.g. AES-256] |
| Integrity verification (hash) | Required after every backup | ▸ [automatic SHA-256 verification / built into tool] |
| Backup encryption keys | Stored separately from backup | ▸ [key location – physical safe / KMS] |
| Off-site / air-gap isolation | REQUIRED | ▸ [solution description – cloud / tape / second DC] |
| Immutable backup | Recommended (ransomware protection) | ▸ [WORM storage / Object Lock S3 / Veeam immutable] |
▸ Organisation completes – backup tool
Backup software: ▸ [e.g. Veeam / Acronis / Bacula / Windows Server Backup]
Cloud provider (off-site backup): ▸ [e.g. Azure Backup / AWS S3 / Backblaze B2]
4. Data Recovery Procedure
4.1 Standard recovery (user-deleted data)
- User submits recovery request to helpdesk / administrator.
- Administrator verifies identity and data permissions.
- Identify backup point prior to loss (RPO).
- Restore to test environment → verification by owner.
- Copy to production environment.
- Close request and document in recovery register.
Completion time (SLA): ▸ [e.g. 4h for critical data, 24h for standard]
4.2 Emergency recovery (disaster / ransomware)
⚠️
BEFORE restoring from backup: ensure the environment is clean (no malicious code). Restoring to an infected environment = re-infecting the backup copies.
- Isolate infected systems (DOC-007 PB-001).
- Prepare a clean target environment (new system / VM).
- Verify backup – is the copy from before the infection? Check integrity hash.
- Restore to clean environment.
- Functional tests.
- Close vulnerability / attack vector BEFORE returning to network.
- Post-recovery monitoring for min. ▸ [72h].
5. Recovery Tests
Requirement – tests minimum quarterly
| Test type | Frequency | Scope | Responsible | Documentation |
|---|---|---|---|---|
| File/folder recovery test | ▸ monthlymin. quarterly | Random file or folder | ▸ IT Admin | Test register |
| Full system recovery test (DR test) | ▸ every 6 monthsmin. 1×/year | Full recovery of critical server | ▸ IT Admin + CISO | DRP test protocol |
| Encryption and integrity verification | ▸ after every backup (automatic) | SHA-256 hash of every copy | Automatic | Backup tool logs |
6. Change History
| Version | Date | Author | Description | Approved by |
|---|---|---|---|---|
| ▸ 1.0 | ▸ DD/MM/YYYY | ▸ | ▸ Initial release | ▸ Board |
DOC-012 Backup and Recovery Procedure | v1.0 | NIS2/ISMS