Backup

Backup (data backup) is a core information security practice that protects the availability and integrity of information. It involves regularly creating redundant copies of business-critical data, configurations, and systems and storing them securely in separate locations. The goal is to enable a timely and complete restoration of operations after data loss caused by technical failures, human error, malware such as ransomware, or physical damage.

An effective backup strategy defines, for each data set, the backup scope, the backup method (full, differential, or incremental), backup intervals, retention periods, and the recovery targets Recovery Time Objective (RTO) and Recovery Point Objective (RPO). The 3-2-1 rule has become established practice: three copies of the data on two different media types, one of which is kept off-site. This is increasingly supplemented by an immutable or offline copy to prevent tampering by attackers.

Backup is closely linked to business continuity and disaster recovery management and is a mandatory building block of common security standards. What matters is not only creating the backups but also verifying them regularly through restore tests: only a successfully tested backup guarantees that the data will actually be usable in an emergency. In addition, backups must be protected themselves, for example through encryption, access control, and separation from production systems.