Backup and data protection policy implementation

A backup is only worth something if you can restore your system from it quickly and completely. That is why we don't stop at configuring backups: we design the policy, implement it, monitor it and regularly check that restoring really works.

This service is for companies and institutions that want to be sure a server failure, a staff error or a ransomware attack won't stop their business for more than a few minutes or hours.

How the implementation works

1. Audit of the current situation. We check which systems and data you have, where backups are kept today, how often they are made and whether anyone has ever tried to restore them.
2. Defining requirements. Together we decide how long each service may be unavailable (RTO) and how much data you can afford to lose in the worst case (RPO).
3. Backup policy. We prepare a document covering what is backed up, how often, for how long, where, who is responsible and what the restore procedure looks like.
4. Implementation. We deploy our own or third-party backup systems, chosen to fit your infrastructure.
5. Monitoring and testing. We check that every backup has run and regularly restore data to a test environment.

The 3-2-1 rule

We implement backups according to the 3-2-1 rule, a proven data protection standard:

• 3 copies of the data: production data and two backups,
• 2 different storage media or systems,
• 1 copy off-site, safe from a failure of or an attack on the main infrastructure.

For systems particularly exposed to ransomware, we also design backups isolated from the production network, which an attacker cannot encrypt or delete.

GDPR and NIS2 compliance

The GDPR requires the ability to restore the availability of personal data promptly after an incident and to regularly test the effectiveness of security measures. The NIS2 directive requires essential and important entities to manage business continuity, including backups.

Our backup policy takes these requirements into account:

• encryption of backups and access control,
• retention periods matched to the type of data,
• a documented restore procedure,
• records of restore test results, ready to show to an auditor.

Maintenance and monitoring

After implementation, we can take over day-to-day backup management under an SLA contract:

• we make backups on the client's behalf, daily as standard and more often for critical systems,
• we monitor every backup job and act on every error,
• we test restores regularly and share the results in our reports,
• for services under SLA, we restore core services within 5 minutes and big data systems within 30 minutes.

Frequently asked questions

Our hosting provider already makes backups. Isn't that enough?

Often not. Hosting backups usually sit in the same infrastructure, have short retention and are never restore-tested. We will check them during the audit and tell you what is missing.

Can you back up systems you did not build?

Yes. The backup policy covers your entire infrastructure, whoever built it.

What if an attack happens despite the safeguards?

We restore your systems from a clean copy and remove the cause of the attack. See: recovery of infected websites and cybersecurity at NETTOM.

Request a backup audit