Testing backup/restore - necessary or vital?

Almost all organizations backup their data, applications, or entire servers - which is good. Far fewer people test whether the backup can be restored. Even fewer are those who test whether business activities can return to normal quickly enough and with the necessary information when there is a need to restore a backup.

One of the reasons for this may be that those responsible for running the business are satisfied with the fact that the IT department or external suppliers perform backups, and thus live in a false sense of security that it is possible to restore data without any impact on the company's activities.

Requirements for RTO and RPO.

The requirements for backup and especially recovery are important. In addition to ensuring that all important information, applications, and infrastructure can be restored, it is also important to determine how long the recovery should take. This is usually called RTO (Recovery Time Objective).

As there are many different backup/restore techniques with a large price difference, an analysis of the value for the company should be carried out. For example, if you lose large amounts for every unit of time where information is not available, the requirements for quick recovery will be greater, and you should invest in a backup/restore solution that handles recovery faster. If the requirements are lower, the opposite applies.

Another requirement is the recovery point, also known as RPO (Recovery Point Objective). This is about how much data you are willing to lose in the event of an incident that requires recovery from a backup. Recovery from a backup can only be done from the latest point in time when a backup was performed. For example, if backups are performed at night or on weekends, you could potentially lose a day or a week's worth of work. If incremental backups are performed close to real-time, you will only miss the latest transactions.

Other things that affect whether the business can recover after an incident in the IT system are how different systems are interconnected. If you have a chain of applications that use or process the information, this should also be taken into consideration. In other words, a chain of resets may be relevant to ensure that the necessary information in the business processes matches up.

Increasing threats from cybercriminals, such as malware that can lie dormant before being activated and thus also affect backups, make it necessary to analyze how long we should keep backups. And the counter-question then becomes, how "old" is the data that is relevant to restore?

Backup/Restore - a part of a Disaster Recovery plan or Business Continuity Plan

What we are saying is that the business requirements for Backup/Restore as part of a Disaster Recovery plan or BCP (Business Continuity Plan) are key to a well-functioning and cost-effective complete solution. It is therefore in the company's interest to ensure that IT, people, and processes can be restored to a normal state after an incident - within a reasonable time and without significant loss of data. The IT department and/or suppliers are usually responsible for proposing and implementing appropriate technologies to meet these requirements.

Cegal and Testing Backup/Restore

Cegal offers assistance with requirements specification and design related to backup/restore (i.e. BCP or Disaster Recovery plan). This includes analysis of information assets, risk analysis, and prioritization of requirements so that the company can cost-effectively restore its operations in the event of disruptions.