Unit IV · Your data
Backups you have actually tested
A backup is only real once you have restored from it. A copy on the same server as the app fails together with the app.
The 3-2-1 rule
A long-standing rule published by the US Computer Emergency Readiness Team (now part of CISA): keep at least three copies of your data, on two different kinds of storage, with at least one copy off-site. A copy in the same hosting account as your app is not off-site.
Test the restore
Pick a backup, restore it into a separate, empty database, and check that the app works with it and that recent records are there. Write down the steps and how long they took. Do it again after any big change.
Backups are data too
Backups hold the same personal data as the live database, so protect them the same way: limit who can reach them, and delete old copies on a schedule you can explain.
Words to know
- Backup
- a copy you can restore from
- Off-site
- stored where a failure at the main site cannot reach it
- Restore test
- actually rebuilding from a backup to prove it works
- Retention
- how long backups are kept
Sources
- US-CERT (CISA): Data Backup Options (2012)
- NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
Checked October 17, 2026. Pages on other sites change; if a source no longer says what the lesson says, the source wins.