What are the best backup retention policies for IT professionals?

Em minha experiencia, o melhor cenário para reten??o de backup consiste em: Backup diario; Backup semanal; Backup mensal; Backup anual. Com essas rotinas o ambiente estará sempre seguro, bkp diario e semanal podemos armazenar em fitas dentro da empresa e o restante externo, trazendo isso para um ambiente cloud, n?o precisamos nos preocupar com fita, o que traz uma menor complexidade, mas o custo normalmente aumenta em cloud.

The best backup retention policies for IT professionals depend on various factors such as regulatory requirements, business needs, and data sensitivity. Ensure that your backup retention policies align with relevant regulatory requirements for data retention in your industry. This may include requirements for retaining data for a specific period or ensuring data integrity and security. Consider the criticality of data to your organization's operations and define retention periods accordingly. Important data that is essential for business continuity may require longer retention periods compared to less critical data.

I will put up with my experience that if you cant afford any data loss as well as data downtime and have infinite storage as well as budget then what you do is backup everything and thats full back up. Similarly if you have constraints of storage/budget and can afford to loose some data then its fine if you go for incremental or differential back up. Also it depends upon the time and network bandwidth you have for firstly taking up back upand then restoration during crisis situation. Further if your data is sensitive like health record data then you cant afford to loose it and hence you need to go for full back up.

Common backup retention strategies in IT include GFS (Grandfather-Father-Son), incremental rotations, versioning, continuous data protection, and aligning with legal/compliance requirements.

Take into account the sensitivity of the data being backed up. Highly sensitive or confidential data may require stricter retention policies to minimize the risk of unauthorized access or data breaches. Balance retention requirements with storage capacity and costs. Longer retention periods may require more storage space and incur higher storage costs. Implement data lifecycle management practices to optimize storage usage and cost-effectively manage backups. Implement versioning and archiving strategies to retain historical versions of data for compliance, auditing, or legal purposes. Define retention periods for archived data based on regulatory requirements and business needs.

Back up retention has to be in accordance to regulatory requirements and business objectives. Only recommendation here is that even if you have storage and you dont have any problem to retain data of decades, just be aware that companies have got into situations owing to unnecessary data with them which either got stolen or was later called for production at various places just because it was there. So keep only that much data which is required.

Two very important points which i wish to highlight here are firstly test all possible scenarios when doing back up testing including network outage, power outage etc and secondly always check integrity of data being restored. Many a times you just do backup testing on presuming a single scenario everytime that your device crashed, there can be scenarios like fire that your entire room is damaged, you want to restore but no network is up and running, similarly for restored data always check it for its correctness and consistency.

I will put it straight that whatever can work for you to save the day for your business is best back up policy and whatever you do is best practise. But somethings which are inescapable are have back up process automated, have versioning to avoid confusion, have back up and multiple locations, regular trainings shall be conducted for restorations, standard operating procedures shall be known to all, if the restoration is from a remote site then network should be high bandwidth and ideally that should also be a hot site kind of arrangement.

I will classify back up into a different set as cloud/remote back up and onsite back up. This is also a way in which we can classify back up in addition to whats already given at point 1. Cloud is when the back up in a CSP premises which are separate from your site Remote is when you have back up at a geographically separate location Onsite is when your back up is at the same location where original data is being preserved