A backup you haven’t tested isn’t a backup. It’s hope.
3-2-1 Rule¶
- ☐ 3 copies of data
- ☐ On 2 different media
- ☐ 1 off-site (different location/cloud region)
What to Backup¶
- ☐ Databases (pg_dump, mysqldump)
- ☐ Configuration (Terraform state, K8s manifests)
- ☐ User uploaded files
- ☐ Secrets and certificates
- ☐ Infrastructure as Code
Automation¶
- ☐ Automated backup schedule
- ☐ Retention policy defined
- ☐ Old backups automatically deleted
- ☐ Backup job monitoring
- ☐ Alert on failure
Security¶
- ☐ Backups encrypted
- ☐ Access restricted (least privilege)
- ☐ Immutable backups (write-once)
Testing¶
- ☐ Restore test at least monthly
- ☐ Full DR test yearly
- ☐ RTO and RPO defined and tested
- ☐ Documented restore procedure
Rule¶
Backup without restore testing is just a false sense of security.
backupdisaster recoverydata