Backup scope

Backup planning should cover application data, databases, runtime files and deployment-specific configuration required to restore service.

Backup protection

• Restrict access to backup storage.
• Protect backup credentials.
• Keep at least one recovery copy independent of the live server.
• Apply retention appropriate to the business.

Recovery testing

A backup is not proven until restoration has been tested. Periodic recovery tests should validate both data and service availability.

Incident recovery

During an incident, preserve useful logs and failure context before performing destructive recovery operations where practical.