Backup policies
Do you back up your data?
If you don't, don't blame yourself. Many multinational companies would struggle to answer this question because, even when backups are made, the operation is not effectively managed. Creating and maintaining efficient backup policies is not enough: you also need to check periodically that they are being followed.
Even a minimally effective backup policy must take at least the following points into account:
What data will be stored?
This is the first question to answer. One way to answer it is to identify the most important information in the company: information whose loss would threaten the very existence of the business. Likely candidates are:
Data from the company's management systems. It is usually kept in databases, and most database management systems offer data export and/or backup options. Even if your company uses cloud-hosted systems, there should be an option to export the data so you don't depend 100% on the provider's reliability;
Unstructured data. This is the information keeping administrators around the world up at night, and it even has its own buzzword: Big Data. "Big" because it is large and grows rapidly every day. It includes spreadsheets, text documents, emails, chats, images and videos that are now part of the daily management of any company. These files should be centralized to make backup easier, usually on a File Server. For home users, folders such as "My Documents", "Pictures" and "Videos" are among those that should be backed up. If your email client downloads messages to your computer, consider keeping a copy on the server by using the IMAP protocol (this is possible with Google's Gmail, for example).
How often should backups run?
How often does the information change? Some companies back up twice a day, once at lunchtime and again overnight. The sooner new information (or a change to existing information) is backed up, the lower the risk of losing it.
Think carefully before answering this question. Getting it wrong can lead to serious losses, such as backing up information that is already corrupted or badly out of date, which means rework if you need to restore.
What equipment and technologies will be used for backup?
How often does the information change? Some companies back up twice a day, once at lunchtime and again overnight. The sooner new information (or a change to existing information) is backed up, the lower the risk of losing it.
Think carefully before answering this question. Getting it wrong can lead to serious losses, such as backing up information that is already corrupted or badly out of date, which means rework if you need to restore.
How much data does each backup generate, and for how long will my equipment be able to handle that volume?
Answering this question correctly will avoid unnecessary investment. For mission-critical systems, you can calculate the cost of downtime and size your investment accordingly. How much would it cost to lose access to your information or lose your work? There is no ready-made formula, but a good approach is to track how your backup files grow over time and project future needs based on that growth rate.
What procedure will be used to check that the policy is being followed? Who will be responsible for this review?
A perfect policy is useless if it is never audited. There must be a review procedure to check whether the policies are effective or need adjusting, and test restores must be performed. It is essential that the audit is carried out not by the person responsible for the backups, but by someone else qualified to evaluate them.
"Regulate the process of copying and storing data to ensure its security, integrity and availability, in accordance with the Information Security Policy."