Backup — the process of creating copies of data for protection and recovery — is the cornerstone of every organization’s data protection strategy. Regardless of company size, data loss can mean operational downtime, financial damage, and in extreme cases, business closure. According to the Veeam Data Protection Trends 2025 report, 76% of organizations experienced at least one data loss incident in the past 12 months. This article explains what backup is, explores the different types, walks through the 3-2-1-1-0 strategy, and provides a step-by-step guide to building a disaster recovery plan that actually works.
What is backup and why is it critical?
Backup is the process of creating a duplicate copy of data to protect it against loss, corruption, or unavailability. A backup enables an organization to restore data to its state before a failure, attack, or human error occurred.
In the context of cybersecurity, backup serves as the last line of defense. When firewalls, EDR systems, and security procedures fail, it is the backup that allows an organization to resume normal operations. However, simply having a backup is not enough — the copy must be current, verified, and inaccessible to attackers.
Why backup matters more today than ever
The scale of threats to business data grows year over year:
- Ransomware — according to the Sophos State of Ransomware 2025 report, 59% of organizations fell victim to ransomware in the past year. Modern variants deliberately seek out and encrypt backup copies before encrypting production data.
- Human error — accidental file deletion, database overwrites, and misconfigurations account for 23% of data loss incidents (IBM Cost of Data Breach 2025).
- Hardware failures — hard drives have finite lifespans. The annual failure rate (AFR) for enterprise drives is 1-3%, which in large environments means regular issues.
- Natural disasters — fires, floods, and power outages can destroy an entire physical infrastructure.
📚 Read the complete guide: BCP/DR: Business Continuity (BCP/DR) in the Era of Cyberattacks
Backup types — a comparison
Not all backups are created equal. Choosing the right backup type depends on recovery time requirements, available storage capacity, and the backup window (time allocated for creating the copy).
Full Backup
A full backup copies all selected data every time it runs. It is the simplest and most reliable type because restoration requires only a single copy. The downside is execution time and large storage requirements.
Incremental Backup
An incremental backup copies only data that has changed since the last backup (whether full or incremental). It is fast and storage-efficient, but restoration requires the full backup plus every subsequent increment in sequence — which extends recovery time and increases risk if any increment is corrupted.
Differential Backup
A differential backup copies all data that has changed since the last full backup. It strikes a balance between full and incremental — faster than full, and restoration requires only two copies (the full backup plus the latest differential).
Continuous Data Protection (CDP)
CDP records every data change in real time or at very short intervals (every few seconds or minutes). It enables restoration to any point in time. It is the most expensive solution but offers the lowest RPO.
Backup types comparison table
| Feature | Full | Incremental | Differential | CDP |
|---|---|---|---|---|
| What it copies | All data | Changes since last backup | Changes since last full backup | Every change in real time |
| Creation speed | Slowest | Fastest | Medium | Continuous |
| Storage usage | Largest | Smallest | Medium | Depends on retention |
| Restoration speed | Fastest | Slowest (multiple steps) | Fast (2 steps) | Very fast |
| Management complexity | Low | High | Medium | High |
| Typical use case | Weekly baseline | Daily working copies | Mid-size company compromise | Critical databases |
The 3-2-1-1-0 backup strategy
The classic 3-2-1 strategy, developed by photographer Peter Krogh, served as the gold standard for data protection for years. In the face of modern threats — ransomware in particular — it has been extended to the 3-2-1-1-0 model.
The 3-2-1-1-0 rules
- 3 copies of data — in addition to production data, maintain at least two backup copies. This minimizes the risk of losing all copies simultaneously.
- 2 different media types — store copies on two different types of media (e.g., local disk + cloud, NAS + tape). This protects against media-specific failures.
- 1 copy off-site — at least one copy in a separate location (different building, city, or cloud). This protects against local disasters.
- 1 air-gapped or immutable copy — a copy that is physically disconnected from the network (air-gapped) or stored in a write-once mode (immutable). This is the only effective protection against ransomware that deliberately targets network-accessible backups.
- 0 errors — regular, automated verification of backup integrity. A backup you have never tested is not a backup — it is hope.
Why air-gap and immutability are essential
Modern ransomware groups (e.g., LockBit, BlackCat/ALPHV, Royal) target backup infrastructure first. Their tactics include:
- Scanning for Veeam, Commvault, and Acronis servers on the network
- Stealing or deleting backup copies
- Only then encrypting production data
An air-gapped copy (e.g., a tape stored in a safe) or an immutable copy (e.g., AWS S3 Object Lock, Veeam Hardened Repository) is beyond the attacker’s reach because it cannot be modified or deleted over the network.
RPO and RTO — the key backup metrics
The two most important parameters defining backup requirements are RPO and RTO. Understanding these metrics is fundamental to planning a data protection strategy.
RPO — Recovery Point Objective
RPO answers the question: how much data can we afford to lose? It defines the maximum acceptable period from which data may be lost as a result of a failure.
- RPO = 1 hour means backup must run at least every hour
- RPO = 24 hours means a daily backup is sufficient
- RPO = 0 (zero data loss) requires synchronous replication or CDP
RTO — Recovery Time Objective
RTO answers the question: how quickly must we restore systems? It defines the maximum acceptable time from failure to full operational recovery.
- RTO = 15 minutes requires hot standby or automatic failover
- RTO = 4 hours requires pre-provisioned standby infrastructure
- RTO = 24 hours allows for manual restoration from backup
Key principle: the lower the RPO and RTO, the higher the cost of backup infrastructure. This is why a Business Impact Analysis (BIA) is essential — it defines realistic requirements for each system.
Where to store backups
The choice of backup storage depends on RPO/RTO requirements, budget, and security needs.
Local backup (on-premises)
Storing copies on local servers, disk arrays, or NAS devices. Offers the fastest recovery but does not protect against physical disasters or advanced ransomware.
Cloud backup
Services such as AWS S3, Azure Blob Storage, Google Cloud Storage, or dedicated solutions (Veeam Cloud Connect, Acronis Cloud). Provides off-site storage, scalability, and often built-in immutability. Recovery time depends on bandwidth.
Tape backup
LTO (Linear Tape-Open) tapes remain a popular medium for long-term archiving and air-gapped copies. They offer low cost per TB, durability up to 30 years, and a natural air gap (a tape in a safe is completely offline).
Immutable backup
Copies stored in WORM (Write Once Read Many) mode or with Object Lock enabled. For the defined retention period, they cannot be deleted or modified — even with administrator privileges. Available in cloud (S3 Object Lock) and on-premises (Veeam Hardened Repository, Dell PowerProtect).
Popular backup tools — comparison
The backup solutions market is broad. Below is a comparison of the most popular enterprise tools.
| Tool | Type | Strengths | Immutability | Approximate Price |
|---|---|---|---|---|
| Veeam Backup & Replication | On-prem + Cloud | Versatility/Hyper-V, M365, instant recovery | Hardened Repository, S3 Object Lock | From $500/socket/year |
| Acronis Cyber Protect | Hybrid | Backup + antivirus in one, simple interface | Immutable storage | From $75/workstation/year |
| AWS Backup | Cloud-native | Native AWS integration, automation, low cost | S3 Object Lock, Vault Lock | Pay-as-you-go (~$0.05/GB/month) |
| Commvault | Enterprise | Advanced data management, compliance, deduplication | Immutable copies | From $1,200/TB/year |
| Dell PowerProtect | Appliance | Hardware acceleration, Cyber Recovery Vault, air-gap | Built-in | From $12,000 (appliance) |
The right tool depends on environment scale, budget, and compliance requirements. For small and mid-size businesses, Veeam or Acronis offer the best functionality-to-price ratio. For large enterprises with regulatory requirements, Commvault or Dell PowerProtect are strong options.
Disaster recovery plan — step by step
Disaster recovery (DR) is the process of restoring IT systems and data after a catastrophe. An effective DR plan should be an integral part of the backup strategy.
Step 1: Business Impact Analysis (BIA)
Identify critical systems and processes. Define RPO and RTO for each. Prioritize systems by business impact — for example, the ERP system and email will rank higher than a document archive.
Step 2: Asset inventory
Create a map of all systems, applications, databases, and their dependencies. Include data stored locally by users (laptops, mobile devices). Without a complete inventory, the DR plan will have gaps.
Step 3: Choose a DR strategy
Based on RPO/RTO and budget, select the appropriate strategy:
- Cold site — an empty location with network infrastructure, requires manual server setup (RTO: days)
- Warm site — a location with partially configured infrastructure (RTO: hours)
- Hot site — a fully operational replica of the production environment with live replication (RTO: minutes)
- DRaaS (Disaster Recovery as a Service) — a cloud-based DR service with automatic failover (RTO: minutes to hours)
Step 4: Documentation and procedures
Write detailed recovery procedures for each system. Include startup sequence (e.g., Active Directory first, then DNS, then application servers). Define roles and responsibilities within the DR team.
Step 5: Testing and verification
A DR plan you do not test is not a plan — it is a document. Test regularly:
- Tabletop exercises — quarterly scenario-based exercises with the team
- Partial recovery tests — monthly restoration of selected systems
- Full DR test — annual, complete failover to the standby environment
Step 6: Continuous improvement
After every test and every real incident, update the DR plan. Document lessons learned. The IT environment changes constantly — the DR plan must keep pace.
Backup security
A backup that is not properly secured can become an attack vector rather than a protection tool.
Encryption
All backups should be encrypted — both at rest and in transit. The standard is AES-256. Store encryption keys separately from the backup copies — ideally in a dedicated HSM (Hardware Security Module) or KMS service.
Access control
Restrict access to backup infrastructure to the minimum number of people necessary. Apply the principle of least privilege and multi-factor authentication (MFA). Monitor and log all operations on backup copies.
Air-gap and immutability
As discussed in the 3-2-1-1-0 strategy section, at least one copy should be physically disconnected from the network or stored in immutable mode. This is the only reliable protection against ransomware.
Monitoring and alerts
Implement backup status monitoring within the SOC (Security Operations Center). Alerts should cover:
- Failed backup jobs
- Anomalies in copy size (sudden decrease = potential data loss)
- Attempts to modify or delete backup copies
- Unauthorized access to backup infrastructure
Backup testing and verification
The statistics are unforgiving: according to Gartner, 37% of backup restoration tests fail. The causes include damaged media, incomplete copies, missing dependencies, and outdated procedures.
How to test backups
- Automated integrity verification — tools like Veeam SureBackup launch virtual machines from backup copies in an isolated environment and verify that systems function correctly.
- Manual restoration tests — quarterly, restore randomly selected systems and verify data completeness.
- Actual RTO measurement — during tests, measure the real recovery time and compare it with the declared RTO. If you declare RTO = 4 hours but the test takes 8 hours, you have a problem.
- Cross-platform tests — ensure copies can be restored on different hardware than the source (bare-metal recovery).
Test documentation
Every test should be documented: date, scope, result, recovery time, issues encountered, and remediation actions taken. Test documentation is also required by regulations such as NIS2, DORA, and ISO 27001.
Backup and incident response
In the event of a security incident, backup plays a dual role:
- Post-attack recovery — restoring systems to their pre-incident state from a clean backup copy.
- Forensic evidence — backup copies may contain traces of attacker activity from before the incident was detected, aiding in analysis of the attack vector and scope of compromise.
This is why incident response procedures must account for preserving backup copies before they are overwritten by the next scheduled backup. When compromise is suspected, the first step should be freezing existing copies.
Summary
Backup is not a one-time task but an ongoing process that requires planning, investment, and regular verification. An effective data protection strategy rests on several pillars:
- The 3-2-1-1-0 strategy as a minimum — three copies, two media types, one off-site, one air-gapped/immutable, zero errors.
- The right backup type matched to the RPO/RTO of each system.
- Backup security — encryption, access control, immutability.
- Regular testing — a backup you do not test does not exist.
- A disaster recovery plan integrated with the backup strategy and incident response procedures.
Remember: the question is not “if” you will lose data, but “when.” The only variable you control is whether you will be able to recover it.
FAQ — Frequently Asked Questions
What is the difference between full and incremental backup?
Full backup copies all data every time — simplest but slowest and uses the most storage. Incremental copies only changes since the last backup — fast and efficient, but restoration requires the full backup plus all increments in the correct sequence.
What is the 3-2-1 backup strategy?
The 3-2-1 rule means: 3 copies of data, on 2 different media types, with 1 copy off-site. The extended 3-2-1-1-0 version adds: 1 air-gapped (offline) copy and 0 errors (regular backup integrity verification).
How often should a business back up data?
It depends on RPO (Recovery Point Objective) — how much data you can afford to lose. Critical systems: every 15-60 minutes (continuous replication). Databases: every 1-4 hours. Working files: daily. Archives: weekly. Test restoration quarterly.
How much does cloud backup cost?
Veeam Cloud Connect: $15-60/TB/month. AWS S3: ~$0.023/GB/month (Standard), ~$0.004/GB (Glacier). Microsoft 365 backup (Veeam): $3-8/user/month. Costs scale with retention period and frequency.
Does backup protect against ransomware?
Yes, but only with an offline (air-gapped) or immutable copy. Modern ransomware specifically targets online backups. The 3-2-1-1-0 strategy with an air-gapped copy is the only reliable protection. Test restoration regularly.
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
- Acronis Cyber Protect — Acronis
- Dell PowerProtect — Dell Technologies
