Skip to main content
Policy Authority
Category: Business Continuity

Backup and Recovery

Also known as: Data Backup and Recovery
Simply put

Backup and recovery refers to two related activities: copying important data to a separate, secure location on a regular schedule, and later restoring that data when the original is lost or damaged. It helps an organization respond to events such as human error, system failure, natural disasters, or cyber incidents like ransomware. In short, backup creates the protective copies, and recovery uses them to return data to a usable state.

Formal definition

Backup and recovery is a paired set of data-protection processes. Backup is the scheduled duplication of critical data to a secure, independent storage location, producing copies that are isolated from the production environment. Recovery is the restoration of that data to a production or usable state following data loss arising from causes such as human error, system failure, natural disaster, or cyberattack. The two functions are distinct but complementary: backup establishes the copies, while recovery is the operation that returns data from those copies. In a GRC context, backup and recovery typically operates as a preventive and corrective control supporting availability and resilience objectives. This entry does not cover implementation specifics, tooling selection, or related but separate disciplines such as disaster recovery planning, business continuity, or defined recovery objectives (e.g., RPO/RTO), which are not addressed in the evidence provided.

Why it matters

Data is central to most organizational operations, and its loss can disrupt service delivery, impair decision-making, and undermine obligations to customers, regulators, and other stakeholders. Backup and recovery addresses a range of loss scenarios that organizations commonly face, including human error, system failure, natural disasters, and cyber incidents such as ransomware. Without reliable copies stored independently of the production environment, an organization may have no practical means of returning affected data to a usable state after such an event.

Within a governance, risk, and compliance context, backup and recovery typically functions as both a preventive and a corrective control supporting availability and resilience objectives. It contributes to an organization's ability to withstand and respond to disruptive events, and it is often examined as part of broader risk assessment and control evaluation activities. The presence of tested backups can materially affect the severity of an incident's consequences, because recovery capability determines whether lost or damaged data can be restored.

It is worth noting that maintaining backups is not by itself a guarantee of recoverability; the ability to restore data depends on the integrity and accessibility of the copies at the time they are needed. This entry does not address defined recovery objectives, disaster recovery planning, or business continuity, which are related but distinct disciplines with their own requirements and considerations.

Who it's relevant to

Risk Managers
Risk managers may consider backup and recovery when assessing exposure to data-loss scenarios and when evaluating the preventive and corrective controls that support availability and resilience objectives. Its presence and reliability can influence how the potential consequences of disruptive events are assessed and treated.
Internal Auditors
Internal auditors may examine backup and recovery as part of evaluating whether controls supporting data availability are designed and operating as intended. In doing so, auditors maintain independence from the management activities that establish and run the backup and recovery processes.
Compliance Officers
Compliance officers may have an interest in backup and recovery where the protection and availability of data relate to applicable obligations. The specific requirements vary by jurisdiction, industry, and organization, and this entry does not address any particular legal or regulatory mandate.
IT and Information Security Teams
IT and information security teams are commonly responsible for operating backup and recovery processes as a first line activity, including scheduling the duplication of critical data and performing restoration when data loss occurs. This function is often relevant to defending against and recovering from cyber incidents such as ransomware.

Inside Backup and Recovery

Backup
The process of creating and retaining copies of data, systems, or configurations so they can be restored following loss, corruption, or unavailability. Backup is a preventive and recovery-supporting measure, not a recovery process in itself.
Recovery
The process of restoring data, systems, or services from backups or other sources to a usable state after a disruption. Recovery is the activity that validates whether backups actually serve their intended purpose.
Recovery Point Objective (RPO)
The maximum acceptable amount of data loss measured in time, indicating how far back a recovery point must reach. RPO commonly informs how frequently backups are taken.
Recovery Time Objective (RTO)
The maximum acceptable duration for restoring a system or service after a disruption. RTO commonly influences the choice of backup and recovery technologies and processes.
Backup types and scope
Approaches such as full, incremental, and differential backups that differ in what data is copied and how restoration is performed. The appropriate approach typically depends on data volume, RPO, RTO, and available resources.
Retention and storage
Policies governing how long backup copies are kept and where they are stored, including on-site, off-site, and offline or immutable copies. Retention requirements may be shaped by regulatory, contractual, and business needs, which vary by jurisdiction and sector.
Restoration testing
Periodic exercises to confirm that backups can be restored within defined objectives. Testing provides assurance that backup processes are effective rather than merely present.

Common questions

Answers to the questions practitioners most commonly ask about Backup and Recovery.

Is having backups the same as having a recovery capability?
No. Creating backups is only one part of the discipline. Backups establish copies of data, but recovery capability depends on the ability to restore that data to a usable state within acceptable timeframes. Untested backups may prove unrecoverable when needed, so the presence of backups should not be treated as evidence of a working recovery capability. The two are related but distinct, and both typically require validation.
Does backup and recovery guarantee protection against data loss?
No. Backup and recovery reduces the likelihood and impact of data loss but does not eliminate it. Residual risk commonly remains from factors such as backup failures, gaps between backup intervals, corruption that propagates to copies, or events affecting both primary and backup locations. It is more accurate to describe backup and recovery as a control that lowers, rather than removes, the risk of data loss.
How are recovery objectives typically defined for a backup and recovery program?
Recovery objectives are commonly expressed through parameters such as a recovery time objective, describing how quickly a system or dataset should be restored, and a recovery point objective, describing the maximum acceptable amount of data loss measured in time. These objectives are generally derived from business impact analysis and vary by system criticality, jurisdiction, and organizational context. This entry does not prescribe specific values, which differ by organization.
How can an organization gain assurance that recovery will work when needed?
Assurance is commonly obtained through periodic recovery testing, such as restoring data or systems in a controlled environment and comparing outcomes against defined recovery objectives. Documented test results support both management oversight and independent assurance activities. The scope, frequency, and rigor of testing typically depend on system criticality and applicable requirements. Note that testing is a validation activity and does not itself perform the backup.
How does backup and recovery relate to broader continuity and resilience planning?
Backup and recovery is commonly one component within wider disaster recovery and business continuity arrangements. It addresses the restoration of data and systems, while continuity planning may also cover people, facilities, processes, and third-party dependencies. Organizations typically align backup and recovery capabilities with the recovery objectives set in continuity planning, though the specific integration varies by organization and sector.
What roles and responsibilities are commonly involved in backup and recovery?
Responsibilities are frequently distributed across lines of responsibility. Operational teams that design, execute, and maintain backup and recovery processes generally sit within the first line. Risk and compliance functions in the second line may set policy, define standards, and monitor. Independent assurance over the adequacy and effectiveness of these controls is typically provided by internal audit in the third line. This separation supports the objectivity of assurance activities.

Common misconceptions

Having backups guarantees that data can be recovered.
A backup that has not been tested through restoration may be incomplete, corrupted, or misconfigured. Recoverability is demonstrated through restoration testing, not by the existence of backup copies alone.
Backup and recovery is purely an IT technical task with no governance or compliance dimension.
While execution is often operational, backup and recovery frequently spans governance (assigning decision rights, RPO/RTO ownership) and compliance (meeting retention and data-protection obligations that may vary by jurisdiction and sector). Treating it as only technical can overlook these responsibilities.
A single backup copy in one location is sufficient.
A single copy may be exposed to the same threats as the primary data, such as site loss or malware. Many practitioners maintain multiple copies across separate locations, including offline or immutable copies, though the appropriate arrangement depends on risk assessment and requirements.

Best practices

Define RPO and RTO for systems and data based on business impact, and align backup frequency and recovery methods to those objectives.
Perform and document periodic restoration testing to confirm that backups can be recovered within the defined objectives, rather than assuming their existence is sufficient.
Maintain multiple backup copies across separate locations, and consider offline or immutable copies to reduce exposure to threats affecting the primary environment.
Set retention and storage policies that reflect applicable regulatory, contractual, and business requirements, recognizing that these may differ across jurisdictions and sectors.
Assign clear ownership and decision rights for backup and recovery, distinguishing operational execution from oversight and assurance responsibilities.
Review and update backup and recovery arrangements as systems, data, risks, and requirements change.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide