How do you design a backup and disaster recovery strategy?

Question

Accepted Answer

A backup and disaster recovery (DR) strategy answers: if we lose data or a whole region, **how much data can we lose, how fast can we be back, and can we actually restore?** It rests on the **3-2-1 rule**, clear **RPO/RTO** targets, and — critically — **regularly tested restores**.

## The 3-2-1 rule

```text
3 copies of the data
2 different media / storage types
1 copy offsite (different region or provider)
→ no single failure (disk, host, datacenter, ransomware) destroys every copy
```

Backups should be **automated** (no human remembering to run them) and **offsite** so a regional disaster doesn't take the backup with the primary.

## RPO and RTO

These two targets drive every design choice:

- **RPO (Recovery Point Objective)** — how much data loss is tolerable, measured in time. RPO of 1 hour means losing at most the last hour of writes, which dictates backup/replication frequency.
- **RTO (Recovery Time Objective)** — how long recovery may take. RTO of 30 minutes means the system must be restored and serving within 30 minutes, which dictates the DR architecture.

```text
frequent backups / replication → smaller RPO (less data lost)
hotter standby infrastructure  → smaller RTO (faster recovery)
both cost money → pick targets per business criticality
```

## DR tiers (cost vs RTO)

```text
Backup & restore  → cheapest; restore from backups on demand   (RTO: hours)
Pilot light       → minimal core running, scale up on disaster  (RTO: tens of min)
Warm standby      → scaled-down live copy, scale up to take over (RTO: minutes)
Multi-site active → full live copies serving traffic            (RTO: ~seconds)
```

## Test your restores

**A backup you have never restored is not a backup — it's a hope.** Schedule regular restore drills: actually rebuild from backup into a clean environment and verify integrity. This catches corrupt backups, missing pieces, and broken runbooks *before* a real disaster.

## Why it matters

Data loss and regional outages are when a company's survival is tested. 3-2-1 ensures a copy survives any single failure; RPO/RTO turn vague "we have backups" into measurable commitments; DR tiers let you match cost to criticality; and tested restores are the only proof the whole thing actually works. Skipping the test is how teams discover, mid-outage, that their backups were useless.