Backup: what every company should know

Backup means copying physical or virtual files, or databases, to a secondary location so they’re preserved if equipment fails or disaster strikes. Backing up data is essential to a successful disaster recovery plan.

Companies back up the data they consider vulnerable to buggy software, data corruption, hardware failure, cyberattacks, human error or other unforeseen events.

Backup and recovery testing examines an organization’s practices and technologies for data security and replication. The goal is to make sure data can be recovered quickly and reliably when it’s needed. Recovering backed-up files is called a restore.

The terms backup and data protection are often used interchangeably, although data protection covers broader goals: business continuity, data security, information lifecycle management, and the prevention of malware and computer viruses.

Why is data backup important?

Because it protects you against data loss, backup is one of the most important infrastructure components in any organization. Backups let you restore deleted files or recover a file that was overwritten by mistake.

Backups are also usually an organization’s best option for recovering from a ransomware attack or a major data loss event, such as a data center fire like the 2021 fire at the OVH data center.

What data should be backed up, and how often?

A backup process covers critical databases and the applications that matter to the business. It’s governed by predefined backup policies, which specify how often data is backed up and how many duplicate copies (called replicas) are needed, and by service level agreements (SLAs), which set how quickly data must be restored.

Best practice is to schedule a full backup at least once a week, usually on the weekend or outside working hours. To complement weekly full backups, companies typically schedule a series of incremental backups, which copy only the data changed since the last backup, or differential backups, which copy the data changed since the last full backup. Working data that changes daily is backed up at least once a day; many current solutions even take incremental copies every hour without slowing systems down.

Backup as a Service: tell me more →

How backup storage media evolved

Businesses usually back up important data to dedicated backup appliances. Backup software, whether built into the appliance or running on a separate server, manages the process of copying data to disk. It also handles processes such as data deduplication, which reduce the physical storage space needed. The backup software also enforces the policies that set how often specific data is backed up, how many copies are made and where the backups are stored.

The best NAS for companies

Before disk became the main backup medium in the early 2000s, most organizations used magnetic tape drive libraries to store their data center backups. Tape is still used today, but mainly for archived data that doesn’t need to be restored quickly. Some organizations use a removable external drive instead of tape, but the basic idea of copying data to removable media stays the same.

Disk backups made continuous data protection possible. Before them, organizations typically created a single backup each night. At first, the nightly copies were all full system backups. Over time, backup files grew larger while backup windows stayed the same or even shrank. That forced many organizations to switch to nightly incremental backups.

In the early days of disk backup, backup software was designed to run on a separate server. It coordinated the backup process and wrote the data to a storage array. These systems quickly became popular because they worked as online backups: data could be copied or restored on demand, without having to mount a tape.

Although some backup products still use separate backup servers, vendors are increasingly moving to integrated data protection appliances. At its simplest, an integrated appliance is a file server equipped with HDDs and backup software. These plug-and-play appliances often include automatic disk capacity monitoring, expandable storage and preconfigured tape libraries.

Some vendors have also started offering backup platforms built on hyperconverged systems. These are groups of standardized servers that manage backup processes together. One of the main advantages of hyperconverged systems is that they scale easily: each node has its own built-in storage, compute and networking resources, and administrators can increase the organization’s backup capacity simply by adding more nodes to the cluster.

Hyperconverged or not, most disk backup appliances let you move copies from disk to tape for long-term retention. Tape systems are still in use thanks to growing tape densities and the arrival of the Linear Tape File System (LTFS).

The first disk backup systems were known as virtual tape libraries (VTLs) because they included disks that behaved just like tape drives. That way, backup applications written to send data to tape could treat the disk as a physical tape library. VTLs lost popularity once backup software makers optimized their products for disk instead of tape.

For a long time, solid-state drives (SSDs) were rarely used for backup because of their price and their endurance under repeated writes. Some storage vendors use SSDs as a cache or as a fast tier for writes to disk-based arrays, especially in hyperconverged systems: data is first stored in flash memory and then written to disk. As the price per terabyte fell and capacities grew, all-SSD backup systems appeared too, chosen where fast restores matter; for large volumes, disk and tape remain cheaper.

Local backup vs. offline backup

Modern primary storage systems have evolved and offer increasingly powerful native backup capabilities. These include advanced RAID protection schemes, unlimited snapshots and snapshot replication tools for secondary or even tertiary off-site backup. Despite these advances, backup based on primary storage tends to be more expensive and lacks the indexing capabilities of traditional backup products. And RAID, however advanced, doesn’t replace backup: see why RAID is not a backup.

Local backups put data on external HDDs or tape systems, usually located in or near an on-premises data center. The data travels over a secure, high-bandwidth network connection or over the company’s internal network.

One advantage of local backups is that they happen behind the network firewall. Local backup is also much faster and gives you more control over who can access the data.

Offline backup is similar to local backup, although it’s most often associated with backing up a database. An offline backup involves downtime, because the copy is made while the database is disconnected from the network.

Today, “offline backup” often also means a copy disconnected from the network (on tape, on a disk taken off the network or, its logical equivalent, in immutable storage) that an attacker can’t reach. It’s one of the best protections against ransomware.

Managed cloud: tell me more →

Cloud backup and storage

Off-site backups are copies of data kept in a remote location, which can be a secondary company data center or rented colocation space. Increasingly, off-site backup means cloud storage: a subscription service with scalable capacity and low costs that removes the need for the customer to buy and maintain backup hardware. For all its growing popularity, choosing backup as a service (BaaS) calls for data encryption and other measures to protect data integrity.

What types of cloud backup are there?

• Public cloud storage. Users copy their data to a cloud service provider, which charges a monthly subscription based on the storage used. There may be extra fees for data transfer, especially egress, that is, when you restore. AWS, Google Cloud and Microsoft Azure are the largest public cloud providers. Smaller managed service providers also host backups in their own data centers or manage their customers’ backups on the big public cloud platforms.
• Private cloud storage. Data is backed up to different servers inside the company firewall, usually between an on-premises data center and a secondary disaster recovery (DR) site. That’s why private cloud storage is sometimes called internal cloud storage.
• Hybrid cloud storage. The company uses both local and off-site storage. Typically, businesses use public cloud storage selectively for data archiving and long-term retention, and private storage for local access and for backing up their most important data, which must be restored quickly.

RezolvIT’s Backup as a Service backs up your data on your network and in the cloud.

Most backup vendors let you copy on-premises applications to a dedicated private cloud, effectively treating cloud backup as an extension of the customer’s data center. When, in a disaster, the applications can be started from the cloud and later brought back on premises, the service is called disaster recovery as a service (DRaaS).

Cloud-to-cloud (C2C) backup is an alternative approach that has taken off. C2C backup protects data on SaaS platforms such as Salesforce, Microsoft 365 or Google Workspace. This data often exists only in the cloud, and SaaS vendors often charge steep fees to restore data lost through a customer’s mistake; once the retention period expires, some data can’t be recovered at all. C2C backup works by copying SaaS data to another cloud, from which it can be restored if it’s lost. You’ll find details in the article on backing up SaaS applications.

Backup storage for PCs and mobile devices

PC users can back up the computer’s internal drive to an external hard disk or to removable media such as a USB flash drive.

Another option is backing up smartphones and tablets to a personal cloud storage service from providers such as Dropbox, Google Drive, Microsoft OneDrive and others. These services usually offer some capacity for free, and you buy extra space as you need it. Unlike enterprise cloud storage, consumer offerings generally don’t provide the level of security and control that businesses need.

On company computers, syncing with OneDrive or Google Drive isn’t a complete backup: a file that’s deleted, or encrypted by ransomware, gets synced too.

Backup software and hardware vendors

In 2021, when we wrote this guide, the vendors selling backup hardware platforms included Barracuda Networks, Cohesity, Dell EMC (Data Domain), Drobo, ExaGrid Systems, Hewlett Packard Enterprise, Hitachi Vantara, IBM, NEC Corp., Oracle StorageTek (tape libraries), Quantum Corp., Rubrik, Spectra Logic, Unitrends and Veritas NetBackup.

The leading enterprise backup software vendors included Acronis, Arcserve, Asigra, Commvault, Datto, Dell EMC Data Protection Suite (Avamar and NetWorker), Dell EMC RecoverPoint, Druva, MSP360, Nakivo, Veeam Software and Veritas Technologies.

The market has consolidated since then: in December 2024, for example, Cohesity took over Veritas’s data protection business, including NetBackup. Before you choose a solution, check the product’s current name and who develops it.

Backup as a Service: backup managed by RezolvIT, through MspCoreX

Windows Server includes the Microsoft Resilient File System (ReFS), which automatically detects and repairs corrupted data. Although it isn’t technically a backup, ReFS is designed as a preventive measure that protects file system data against corruption.

VMware vSphere offers a suite of tools for data protection, high availability and replication. The VMware vStorage APIs for Data Protection (VADP) let VMware or compatible third-party backup software safely take full and incremental backups of virtual machines. VADP makes the copies using snapshots created by the hypervisor. As a complement to backup, vSphere live migration lets you move virtual machines from one server to another to limit the impact of an incident. VMware Virtual Volumes also helps back up virtual machines. Since November 2023, VMware has been part of Broadcom.

Backup types explained

• Full backup captures a copy of the entire data set. Although it’s considered the most reliable backup method, a full backup takes a long time and needs a lot of disk or tape. Most organizations run full backups only periodically.
• Incremental backup is an alternative to full backup: it copies only the data changed since the last backup, whatever its type. The copies are small and fast; the downside is that a full restore needs the last full backup and every incremental copy made after it, so it takes longer.
• Differential backup copies the data changed since the last full backup. That makes a full restore faster, since it needs only the last full backup and the last differential backup. For example, if you run a full backup on Monday, Tuesday’s backup will, at that point, be similar to an incremental one, while Wednesday’s will contain everything that has changed since Monday. The downside is that differential backups grow from one day to the next and take up more and more of the backup window.
• Synthetic full backup combines existing copies: the backup server produces an additional full copy from the original full backup and the data in the incremental copies, without reading all the data from the source again. The resulting file isn’t a direct copy of any current or previously created file; it’s synthesized from the original file and the later changes.
• Incremental-forever backup minimizes the backup window while giving fast access to recovery data. It captures the full data set only once, then adds only incremental copies. Copying only the changed blocks is also known as delta differencing. Full copies of the data sets are usually stored on the backup server, which automates restores.
• Reverse-incremental backup keeps the changes between two successive states of the data. After an initial full backup, each subsequent incremental backup applies the changes directly to the existing full copy. Each time, this produces a new synthetic full copy, and you can still go back to the earlier full copies.
• Hot backup, or dynamic backup, applies to data that stays available to users while the backup is running. This method avoids downtime and lost productivity. The risk is that if data changes during the backup, the resulting copy may not match the final state of the data.

You’ll find more examples in the article on backup types and why you need them.

Techniques and technologies that complement backup

• Continuous data protection (CDP) covers technologies designed to strengthen data protection. A CDP-based storage system backs up data whenever a change occurs. CDP tools let you create multiple copies of the data. Many CDP systems have a built-in engine that replicates data from a primary server to a secondary backup server and/or to tape. Disk-to-disk-to-tape backup is a popular architecture for CDP systems.
• Near-continuous CDP takes backup snapshots at set intervals, unlike storage system snapshots, which are taken every time new data is written.
• Data reduction lowers the storage space used. There are two main methods: compression and data deduplication. They can be used separately, but vendors often combine them. Reducing data size affects backup windows and restore times.
• Disk cloning means copying the contents of a computer’s drive, saving it as an image file and transferring it to a storage medium. Disk cloning is used to set up new computers, to restore a system or to return it to its original configuration.
• Erasure coding, or forward error correction, emerged as a scalable alternative to traditional RAID and is most often associated with object storage. RAID spreads data across several disks and uses parity for redundancy and resilience. Erasure coding splits data into fragments and encodes them together with additional redundant data. The fragments are stored on different storage media, nodes or geographic locations, and the data can be rebuilt even if some of the fragments are lost.
• Flat backup is a data protection scheme in which a direct copy of a snapshot is moved to low-cost storage without traditional backup software. The original snapshot keeps its format and location; the copy is mounted if the original becomes unavailable or unusable.
• Mirroring places data files on several servers so they stay accessible to users. With synchronous mirroring, data is written to the local and the remote disk at the same time, and local writes aren’t acknowledged until the remote storage confirms them; that way, both locations hold an identical copy of the data. With asynchronous mirroring, by contrast, local writes complete before the remote server confirms them.
• Replication lets you choose the number of replicas, that is, the copies of the data needed to keep the business running or to resume it. Replication copies data from one location to another and provides an up-to-date copy that speeds up disaster recovery.
• Recovery in place, or instant recovery, lets you temporarily run a production application directly from a virtual machine backup, so data stays available while the primary virtual machine is restored. Mounting a copy directly on a backup server can cut system-level recovery to a few minutes. Performance is lower, though, because backup servers aren’t sized for production workloads.
• Storage snapshots capture a set of reference markers on disk for a given database, file or storage volume. Users rely on these markers to restore data from a specific point in time. Because it depends on the source volume, a snapshot isn’t a complete backup and doesn’t protect data against hardware failure.
• Immutable backup keeps copies that, once written, can’t be changed or deleted until the set period expires, not even by an administrator. It’s an essential protection against ransomware, which also tries to delete or encrypt backups.

Snapshots generally fall into three categories: changed block, clones and CDP. They first appeared as a management tool in storage systems; virtualization added hypervisor-created snapshots. Snapshots can also be taken by backup software or even from inside a virtual machine.

Backup as a Service: tell me more →

How to choose the right backup option

When you decide which type of backup to use, you need to weigh several key considerations.

Companies usually combine several backup types, depending on how important the data is and how much of it there is. A backup strategy should be driven by each application’s SLAs for data access and availability, by the recovery time objective (RTO, how long a system can stay down) and by the recovery point objective (RPO, how much data you can afford to lose). The choice of backup solution also depends on how versatile the backup application is: it must guarantee that all data is copied, handle replication and recovery, and allow efficient backup processes.

Creating a backup policy

Most companies create a backup policy to govern the data protection methods and types they use and to make sure critical business data is backed up consistently and regularly. The backup policy also gives the IT department a checklist to follow, since IT is responsible for protecting all of the organization’s critical data.

A backup policy should include a backup schedule. Policies are documented so that other people can follow them to back up and recover data when the main backup administrator isn’t available.

Data retention policies are often part of the backup policy, especially for companies in regulated industries. Predefined retention rules can automatically delete data or move it to other media after a set period. They can also be set for individual users, departments and file types.

A backup policy should require an initial full backup, along with a series of differential or incremental backups between full backups. At least two full backups should be kept, with at least one of them off site.

The 3-2-1 backup rule: what it is and what alternatives exist

Backup policies need to focus on recovery, often more than on the backup itself, because saved data isn’t much use if it can’t be recovered when you need it. And recovery is essential to the disaster recovery plan.

In the past, backup policies dealt mainly with moving data to and from tape. Now most data is copied to disk, and public clouds are often used as backup targets. Moving data to disk, to the cloud or to tape works differently for each destination, and the policy has to reflect that. Backup processes can also vary by application: a database, for example, may need different handling than a file server. You’ll find a ready-made model in the backup strategy guide, with a free template.

How do you protect backups from ransomware?

Keep at least one offline or immutable copy, protect the backup console with two-step verification and test restores regularly. In recent years, these things have become as important as the backup itself:

• Attackers go after backups first. Ransomware looks for and deletes backups before it encrypts your data. That’s why, for many vendors, the 3-2-1 rule has become 3-2-1-1-0: one extra copy, offline or immutable, and zero errors when restores are verified.
• Separate accounts. The backup console doesn’t use the same administrator account as the rest of the network, and it has two-step verification.
• Cloud data needs backup too. Microsoft 365, Google Workspace or an online CRM store your data, but they don’t protect it from accidental or deliberate deletion once the retention period expires.
• Backup is part of your legal obligations. Backups contain personal data, so GDPR applies to them (since May 2018): encryption, restricted access, a clear retention period. For companies covered by NIS2 (transposed in Romania by GEO 155/2024), backup management and disaster recovery are mandatory measures.
• Restores get tested. Schedule test restores and write down how long they took. Only then do you know whether you meet your RTO.

RezolvIT offers companies Backup as a Service, with backups of your data on your network and in the cloud, and handles IT security for laptops, desktops, servers and mobile devices. We’re ISO/IEC 27001 certified for information security. If you’d like us to check your company’s backup, ask for a free IT audit.