How to Create a Backup Plan That Works: A Practical Guide

Safeguarding an organization’s data is both essential and increasingly complex in the face of today’s sophisticated cyber threats. That’s why before taking any action, it’s crucial to build a comprehensive, well‑designed backup plan. One that reflects the unique characteristics of your infrastructure and aligns with the highest cybersecurity standards.

In this article, we discuss what key components a backup plan should cover and how to address them in practice. The insights are complemented by advice from our internal experts, an Infrastructure Administrator and a CISO. You’ll also find a practical cheat sheet at the end.

Determine what and to what degree requires data backup

Your organization surely relies on systems and data so critical that losing them would bring operations to a halt and trigger a cascade of unpleasant consequences. Including these assets in your backup plan is non‑negotiable. But it’s just as important to understand how to handle the parts of your infrastructure that aren’t mission‑critical. 

Catalog environments requiring backup and recovery

Corporate environments typically encompass servers, Hyper-V or VMware hypervisors with virtual machines, user computers (endpoints), and cloud services (e.g., Microsoft 365, Jira, Confluence).

As part of the inventory process, determine which environments are critical. These are environments whose failure entails severe consequences, making the organization unable to operate, namely:

• Domain controller server
• Mail server (on-premises or in the cloud, e.g., Exchange Online)
• Servers hosting vital databases (e.g., customer or financial data)
• Laptops of the CEO and board members
• Computers running accounting software
• Assets responsible for production (e.g., a ICS/OT workstation controlling a production line, sales representatives’ laptops)

Determining what is critical should be based on a documented risk analysis. The key is to answer the question: The unavailability of which asset will affect the organization the fastest or most severely?

Piotr Pogorzelec, Infrastructure Administrator, Xopero Software

You need to include entire critical environments in your backup plan. This is to ensure you can restore them easily and maintain business continuity.

Tip: If you intend to back up the organization’s entire infrastructure and have sufficient storage space for backup data, consider setting up an independent, more frequent backup job for critical environments.

Classify data (critical vs. non-critical)

The selection of data for protection must be dictated by a risk analysis and specified in the organization’s Business Continuity Plan (BCP). It is generally accepted that all ‘production‘ assets (used by systems providing services to clients), shared assets, and those serving as baselines (process documentation, action plans, templates, as well as marketing and training materials) should be protected.

Piotr Pogorzelec, Infrastructure Administrator, Xopero Software

For non-critical environments, you can implement data classification to save storage space and shorten backup windows.

For example, regarding regular employees’ laptops, the backup should cover:

• Folders containing content created by employees (e.g., documents, graphic and video files for designers, etc.)
• Folders with configuration files for production tools (e.g., development environments)
• Application databases (e.g. accounting software) 

Conversely, to conserve space, you can skip the following assets:

• Temporary folders
• System folders, which can be easily recovered by redeploying the operating system

On one hand, it’s good practice to back up everything (disk image) on an employee’s device to facilitate a quick return to work after a failure. On the other hand, when a critical asset resides exclusively on a specific workstation (and in its backups), this usually points to a deeper flaw in the established process. 

It is vital to build employee awareness regarding business continuity requirements, so they proactively report instances where their workstation de facto becomes a production environment. This helps prevent disasters rather than merely minimizing their duration or scope.

Piotr Pogorzelec, Infrastructure Administrator, Xopero Software

Choose security technologies (encryption, immutability, and air gap)

End-to-end encryption, immutable backups, and backup data isolation (air gap) are mandatory components of a backup plan when you consider:

• The ubiquity and destructive nature of modern threats, such as phishing-as-a-service, ransomware, prompt injection, etc., which target not only production data but also the backups themselves
• The necessity of regulatory compliance with modern cybersecurity frameworks (e.g., the NIS2 directive) regarding post-attack recovery capabilities and business continuity assurance

💡 Learn more about the modern threat landscape to better protect your organization. Download the latest Xopero report “Contemporary Cybersecurity Landscape” based on proprietary research among cybersecurity specialists.

Which technologies should you deploy to protect backup data? See the table below:

Security technology	Data to apply the technology to
Encryption	All data
Immutable backup	Critical data
Air gap backup	Critical data

While you need to apply encryption to all data, use the other two technologies deliberately. Immutable backups, though highly effective against ransomware, prevent the deletion of backups for a specified duration, thereby reserving storage space. Air gap backups require extra storage and configuration, which means they should also be reserved for protecting the most critical data.

Decide on backup schedule

The schedule involves different types of backups that run automatically and periodically at various intervals—full, incremental, and differential. 

When discussing the schedule in the context of a backup plan, you need to consider three key factors:

• Storage consumption—a full backup is indispensable because you need it to restore data, but it consumes the most space. Incremental backups take up the least space, while differential backups represent a compromise between the two.
• Execution frequency—you typically run full backups less frequently, such as weekly or monthly. For other types, this interval can be significantly shorter coming close to continuous backups. However, there is a risk that a backup job might not finish before the next one is scheduled to start, potentially leading to errors and failed backups. In practice, running incremental or differential backups at a shortest interval of 1 hour should provide a safe buffer. If your organization demands shorter RPO and more frequent backups, verify carefully that the set frequency will not cause overlapping jobs. Alternatively, break down the backup into smaller jobs.
• Recovery speed—this is a critical consideration for ensuring the business continuity of critical assets. You can restore data the fastest from a standalone full backup. If your full backup must be merged with incremental or differential copies, the process will take longer. Fortunately, your backup tool makes sure that everything runs automatically, in the background. 

Learn more about backup types, along with their advantages and disadvantages

The schedule must balance the two conflicting aspects:

• Legal, certification, and risk analysis requirements (typically aiming for “as frequent as possible”);
• Business, operational, and data-type limitations (typically aiming for “as infrequent as reasonable”):
  • How much can the organization afford to pay for storage while maintaining profitability?
  • How frequently can backups run without data transfers exhausting the host’s, device’s, backup worker’s, etc. network bandwidth?
  • How will highly frequent backup routines impact the load on hosts directly serving clients and on employee endpoints?
  • How frequent data retrieval will an external service provider tolerate before introducing throttling or invalidating access credentials/terminating services?

It is generally assumed that for most assets, backups must be performed at leastonce a day, with critical assets being secured every hour, alongside other mechanics that increase availability (HA mechanisms, hot-standby replicas).

Piotr Pogorzelec, Infrastructure Administrator, Xopero Software

Address backup storage considerations

The second essential domain of a data backup plan involves the storage of the created copies.

Choose the backup storage location

The choice fundamentally comes down to local and cloud-based solutions for storing data. In the table below, we compare the advantages and disadvantages of each approach:

	Local storage	The cloud
Advantages	– Sovereignty and independence from providers – Data within company’s headquarters/office – No dependency on internet connectivity – Faster data transfer rates	– No infrastructure management required – Low, predictable costs in the form of a monthly subscription – Simple configuration
Disadvantages	– Requirement to manage infrastructure – More complex configuration – High upfront costs of equipment purchase and replacement	– Dependence on the provider – Risk of service outages – Data egress fees, e.g., during data restore – Dependence on the ISP – Slower transfer rates and throttling

For maximum security, combine both approaches to ensure offsite backup replication. You can read more about it below, in the section dedicated to replication.

The most secure and straightforward model for data preservation is storing it in multiple secure, approved locations and in multiple versions. 

It is worth ensuring that data is distributed across several geographical locations (ideally more than 2), so that a local incident does not lead to a total loss of availability. However, when planning backup locations, keep in mind that ‘too many’ can also pose a challenge. Each location must be actively monitored and (regularly!) verified for security, completeness, and data integrity.

Piotr Pogorzelec, Infrastructure Administrator, Xopero Software

Calculate the volume of data to protect

After selecting the storage destination, calculate how much storage capacity you’ll need. This is necessary for purchasing local storage or provisioning the right cloud storage tier.

To perform a ‘pessimistic’ (simplest) estimation of the total backup size, the following information is required:

• The combined size of all storage drives on protected devices and data in cloud services
• The planned data retention, i.e. how many copies (full, incremental, and differential) must remain available

With these variables, you can calculate that—in a major simplification—the maximum expected data volume will equal:

[number of full copies in the retention window] * [total size of protected data] + [number of incremental copies in the retention window] * [total size of protected data] + [number of differential copies in the retention window] * [total size of protected data]

Piotr Pogorzelec, Infrastructure Administrator, Xopero Software

You can get the information on the size of protected data most easily through the following methods:

• Servers and endpoints—infrastructure management systems like SCCM/Intune (provides total drive sizes only) or custom scripts (provides precise data metrics)
• Virtual machines—host management interfaces (e.g., ESXi Host Client or Hyper-V Manager) provide visibility into used and free space
• NAS drives and SMB shares – visibility via file managers (e.g., Windows Explorer, Nautilus). For NAS systems, you can also use dedicated web management panels.
• Cloud services—storage metrics are usually accessible via administrative settings panels (e.g., Confluence) or API requests (e.g., GitHub). In some instances, you need to combine data from multiple services, for example, here’s a simplified instruction for Microsoft 365.

At the same time, deployed backup technologies, such as immutable backup, compression, and deduplication, will also impact the final backup size. This impact can be either positive or negative—read on for more details.

Use immutable backup for ransomware protection

The immutable backup technology acts as a lock that prevents the modification and deletion of backup data for a specified timeframe (until the lock expires). In other words, it shields the backup from being compromised by ransomware.

Deploying immutable backups, consider the following factors:

• The backup software must support immutable copies.
• The storage repository must also be compatible with S3 Object Lock. Such compatibility is offered by major cloud providers (e.g., AWS) and local all-in-one backup appliances.
• Avoid setting excessively long retention lock periods, and restrict immutability to critical data. This will prevent the accumulating space reserved by immutable backups from completely exhausting the available storage capacity.

Learn more about immutable backup in our dedicated article

Deploy compression and deduplication

Technologies such as compression and deduplication (skipping duplicate data blocks in subsequent backups) enable significant space savings in the storage repository. Deduplication can be very effective in this regard, in particular when data redundancy across the protected environments is high.

To leverage both technologies, they must be natively supported by your backup software or all-in-one appliance. Another critical factor is the computing power of your infrastructure, since data processing takes place at the source, before the data is moved to the storage. Therefore, for legacy assets, it is worth evaluating which option is more cost-effective: a) upgrading a legacy asset (e.g. a server) to be able to save storage space through these technologies, or b) retaining the old infrastructure and creating a separate backup process/job for it without enabling compression and deduplication.

Plan data retention based on organizational and legal requirements

Retention is a core pillar of a backup plan. While it primarily lets you recover historical data, it is equally vital for compliance purposes. 

If your organization handles critical or sensitive records, backups containing this data may mandate extended, multi-year retention policies. Here are a few examples:

Data Type	Retention Period	Legal Basis
Medical employee records	employment period + 30 years	US labor legislation
Tax documents	3 years	US IRS Recordkeeping Guidelines
Customer personal data collected for marketing purposes	Until consent is withdrawn	GDPR

Short-term retention constraints (e.g., up to 1 year) are a common shortcoming of native backup options bundled with cloud platforms. To follow your backup plan assumptions in full, choose a backup system that provides flexible, unlimited retention policies.

Implement backup replication for resilient protection

Replication is about creating copies of backups in secondary locations. The goal is to protect the organization against the total loss of a backup repository in a single location, for example, due to natural disasters. 

In the backup industry, there are established replication frameworks such as the 3-2-1 or 3-2-1-1-0 backup rules. The former states that you should maintain at least 3 copies of data (production + 2 backups), store them across 2 different media types, and keep at least 1 copy offsite (e.g., in the cloud).

At the technical layer, the backup policy should obligatorily implement the 3-2-1-1-0 strategy as an evolution of the classical 3-2-1 rule. This is currently the ‘gold standard’ of the IT industry.

Eryk Trybulski, CISO, Xopero Software

When incorporating replication into the backup plan, keep the following considerations in mind:

• Replication frequency—it is best practice to replicate backup copies in real time. In other words, as soon as a backup task finishes, replication to alternative locations should be triggered automatically. With modern backup tools, this process can be 100% automated.
• Replicated copy destinations—never store two copies in the exact same physical location. For instance, if the first backup copy is stored on an all-in-one appliance or a local network share (SMB), the second copy should ideally be replicated to the cloud.
• Compliance—replication is a core component of Business Continuity and Disaster Recovery (BCDR) readiness. Consequently, it plays an important role in achieving compliance with frameworks such as the NIS2 directive.

Learn more about offsite data storage and backup location diversification

Ensure efficient and effective data recovery

A backup that cannot be restored is useless. Therefore, a robust backup plan must integrate vital components from the domain of data recovery.

Define RPO and RTO metrics for disaster recovery

In the area of disaster recovery, the following two metrics are paramount:

• Recovery Point Objective (RPO)—defines how frequently backups must run, or, in other words, how much data loss an organization can tolerate.
• Recovery Time Objective (RTO)—defines the maximum allowed timeframe to restore a system, an app, or a service following an outage, cyberattack, human error, accidental deletion, etc.

RPO is a nuanced metric. To calculate it, you need to consider the input of business stakeholders (e.g., executive board) and a number of factors (e.g., financial losses, brand reputation, customer disruptions). 

According to industry standards, it can range from: 0 to a few seconds (financial transaction systems, life-support systems), a few minutes to an hour (CRM platforms, hospital databases), or several hours to a full day (warehouse management systems, internal HR/payroll systems).

To calculate RTO, you need to run actual backup restoration tests that we discuss below.

Defining explicit RTO and RPO metrics not only brings predictability to recovery processes but is also vital for regulatory compliance:

Regarding backup management, NIS2 mandates a risk-based approach. The risk is determined by the RPO and RTO parameters corresponding to the criticality of the processed data and the services provided.

Eryk Trybulski, CISO, Xopero Software

Crucially, the shorter the RPO and RTO values your organization demands, the higher the financial expenditures required to build out the corresponding backup infrastructure.

Check out our comprehensive guide to RPO and RTO

Plan backup testing procedures

You should test-restore backups and verify backup data integrity on a regular basis. This requires dedicating appropriate time and provisioning staging environments. You need to estimate these resource allocations, using the same criteria as for the backup schedule (regulatory compliance requirements vs. business and operational limitations).

Testing must not be superficial or limited merely to reviewing documentation. It must deliver objective proof of the organization’s capability to restore critical processes within a timeframe that does not exceed the defined RTO and RPO thresholds.

Eryk Trybulski, CISO, Xopero Software

The optimal testing frequency for recovery procedures is monthly. Due to the complexity of modern infrastructures and data volumes, organizations often run tests less frequently in practice. However, the maximum allowable interval for a full data restoration drill is six months. 

Once staging environments are configured—which obviously takes time and incurs costs—the execution workflow typically includes:

1. Navigating the backup software UI to initiate restoration jobs
2. Manually validating the integrity of the recovered data

Automation of testing and verification routines is generally feasible within virtualized environments (e.g., VMware). 

Through routine drills, you can gauge the average time required to recover specific environments, thereby establishing accurate RTO. Testing is also an important dimension of compliance:

The NIS2 directive emphasizes regular verification of backup integrity and recoverability via cyclical restoration tests. The results of these tests must be documented and reported at the board level.

Eryk Trybulski, CISO, Xopero Software

Data backup plan – a cheat sheet for administrators

The table below provides a consolidated summary of all discussed aspects of a backup plan along with the general steps for execution. You can print it for a quick reference:

Backup plan component	Execution steps (How to implement?)	Done?
Establish Protection Scope
Catalog environments	Determine which environments must be secured and identify what is critical to the organization.	yes/no
Classify data according to criticality	Isolate critical data: production assets, shared assets, and core baselines, while identifying data that can be safely excluded.	yes/no
Secure backup copies	Configure encryption, immutability, and air gap technologies.	yes/no
Decide on backup schedule	Select backup types based on storage consumption constraints, execution frequency, and recovery velocity targets.	yes/no
Manage backup storage aspects
Choose the backup storage location	Select appropriate repository and storage tier technologies.	yes/no
Calculate the volume of data to protect	Define retention windows, estimate total data volume for protection, and run capacity calculations.	yes/no
Use immutable backup for ransomware protection	Evaluate how data immutability locks and reserves storage capacity over time.	yes/no
Optimize storage footprint	Deploy compression and deduplication mechanisms.	yes/no
Plan data retention	Establish how long copies must be retained based on recovery needs and legal compliance targets.	yes/no
Implement replication & offsite redundancy	Deploy the 3-2-1 (or ideally 3-2-1-1-0) framework, factoring in destination routing, sync frequency, and compliance.	yes/no
Ensuring Efficient Recovery Operations
Define recovery metrics	Calculate required RPO and RTO thresholds based on a Business Impact Analysis (BIA).	yes/no
Plan backup restore tests and data verification	Conduct and document regular recovery drills, verifying the integrity of restored environments.	yes/no

Execute your backup plan in practice with Xopero ONE

As a dedicated backup and disaster recovery solution, Xopero ONE allows you to easily put the components of your backup plan into action:

• Add your inventoried organizational environments by clicking Add new on the Dashboard. Then, follow the integration wizard that you launch by clicking the tile of the chosen platform:

• Next, seamlessly integrate your organization’s storages by navigating to Storages > Add storage and configuring all the settings. Supported options include local storage (SMB, NFS, local folders) as well as popular cloud providers (AWS, Azure, Google, Backblaze, Wasabi, or any S3-compatible vendor). By default, you are equipped with Xopero Cloud, our cloud storage, and, in the case of Xopero Unified Protection (all-in-one appliance), a local S3 storage:

• Following that, go to Plans > Backup > Add plan to build automated backup routines that our software will run for you. You can create multiple distinct plans customized for all organization’s data, critical data only, specific branches only, legacy system only, and more:

• With the backup plan wizard, configure the automated execution schedule where you can choose backup types, execution frequency, and operational windows aligned with your RPO goals, alongside custom retention rules:

• Leverage the Advanced Settings panel to toggle and tune security features tailored to your needs, including encryption, compression, deduplication, and more:

• Navigate to Plans > Replication > Add plan to enable automated replication routines, ensuring offsite redundancy and highly resilient data security:

• When it’s time to verify backup integrity, run test restores for any environment type, using designated & isolated test environments. Measure recovery times to establish precise, data-driven RTO benchmarks. For VMware virtualized environments, you can fully automate the validation process:

Interested in Xopero’s offerings? To receive a custom quote or schedule a live demo of Xopero Unified Protection, contact our sales department. 

Alternatively, you can start testing Xopero ONE right now with a free 14-day trial by clicking the button below.

Try for free