Backup scheduling best practices to ensure availability

Why is a backup schedule needed?

Backup schedules are essential IT activities, as they ensure several important activities are performed and issues are addressed, such as:

• Disaster recovery. Recovering and restarting critical systems, VMs, data files and databases.
• Start times and completion times for all regular backups defined. The schedule must include all data backup activities and include testing activities as needed; in addition, the backup tool and network resources being used can be specified.
• Restore files that are accidentally deleted. It's happened to all of us at some time and it helps to have a safety net in case work files or other critical data are erased.
• Effect of backup activities on production activities. A backup schedule can help keep production systems operating at peak performance, with backups occurring outside of production schedules.
• Satisfaction of compliance and audit requirements. If the organization is required to comply with certain regulations and standards regarding data protection, and is periodically audited for general IT controls, schedules are important sources of evidence in these areas.
• Compliance with recovery time and recovery point objectives (RTOs/RPOs). These important metrics are essential for managing data backup and recovery; schedules can demonstrate that they are being addressed.

Key issues in backup scheduling

Although scheduling backups might seem like a no-brainer, several components of the process must be addressed within IT departments and reviewed with business unit leaders and senior management.

Addressing these items will ensure a comprehensive, auditable schedule that is easily understood and can be implemented by designated data backup team members and others, if needed, in an emergency. Following is a list of key concerns for planning and executing data backups.

1. What needs to be backed up?

Data and system owners should specify the frequency of their backups and what should be backed up. Normally, data administrators should back up everything -- or specific parts -- in the IT environment with a frequency acceptable to business unit leaders and cost-effective operations.

Organizations should also consider the cost of backups and the effect of backups on system -- and company -- performance. For example, it might make sense to replicate the entire system or critical portions of the system and specific individual files and databases to an alternate storage medium and perform incremental backups to that environment.

2. Location of systems and files to be backed up

Identify if the working location will be an on-site server, storage device or perhaps a cloud-based backup arrangement. This can be included in the backup schedule and should also be specified in data backup policies and procedures, especially from compliance and audit perspectives.

3. Who performs backups?

The data backup administrator's activities should be governed based on discussions with system owners and data owners. Individual users might also back up their own data files; this should be addressed by an IT policy for data management. Other IT employees should be identified as potential backup staff to the primary backup administrator(s). This might involve some internal training from the data admins as well as vendors whose technology resources are used for backups.

4. Time frames for backups

Points in time when data and system backups can occur should be defined based on business requirements. For example, some systems and data files might need to be backed immediately when they have been modified. This reflects their criticality to the business. Full backups are often performed after business hours weekdays and over weekends. More frequent backups are governed by the business and their execution might depend on specific systems and network resources.

Backup time frames are influenced by several variables:

• system or service that performs the backups;
• location of the backups -- for example, on site or remote;
• time of day for performing backups;
• use of mounted or unmounted file systems;
• RPO/RTO metrics to be satisfied; and
• requirements as specified by system/data owners and senior management.

Backup administrators should periodically consult with system owners on these criteria to ensure backup policies, procedures and schedules are appropriate.

5. How frequently do systems and data files need to be backed up?

Some files are updated often during a typical day, such as customer data files, requiring admins to back up these files more frequently. They might consider backing them up at the end of each day -- factoring in all incremental revisions -- so that an up-to-date backup is saved.

Other situations might require the immediate backup of changes so files are always current. Other files might not need to be backed up regularly and, as such, could be candidates for alternative storage, such as tape.

RPO requirements might also influence the frequency of backups. For example, if the RPO for certain critical files is 10 seconds or less, the backups will likely be more frequent, and the technology used for those backups -- e.g., data mirroring, data replication, high-speed low-latency networks -- will also need to be considered.

System backups might need a different schedule than data files and databases. Backups should occur any time one or more parameters in a system change in the course of daily operations. This suggests a more ad hoc approach to system backups; each organization will need to establish those requirements.

6. Restoration of data from backups

Backups are created to ensure that if the recovery or restoration of a system and/or data is needed, those resources will be as current as possible. An organization should consider the criticality of systems and files at this point so it can establish the priority of backing up and the priority of restoration. These items should be factored into backup scheduling.

7. Location of restored systems and data

In an emergency, it might be necessary to restore systems or data to an alternate platform, as opposed to the original system. This is a key consideration for disaster recovery. Cloud-based platforms are increasingly popular approaches to this requirement. Managed service providers (MSPs) that specialize in data backup and storage are also viable alternatives. The key is to locate backed-up resources at a sufficient distance from the firm's primary location so that the risk of loss at alternate storage locations is greatly reduced.

Types of backups and examples

The following are the typical types of backups:

• Day zero backups are performed when a new system is fully installed and accepted by the system owner. It establishes the initial baseline for future updates.
• Full backups store all the systems and files within the system, or they store selected systems and files as defined by the system/data owner. Companies should perform these on a regular basis, such as once a week, and they should also consider backups when a major change to the IT infrastructure occurs.
• Incremental backups create a copy of all the files that have changed since a previous backup.
• Differential backups create a copy of all the files that have changed since the last full backup.

Examples of frequently used systems and files for backup scheduling include:

• Individual user files
• Databases
• VMs
• Password and group files
• Accounting files
• Configuration files
• Terminal and port files
• Network files

Developing and implementing a backup schedule

Organizations might need to perform some incremental backups several times each day, whereas others might need more infrequent updates. The increased use of VMs makes efficient and timely backups even more important. In a disaster, enterprises will need to recover and restore quickly to resume operations with minimal downtime.

Setting up a schedule requires a detailed and accurate list of all systems to be backed up, as well as all data files and databases to be backed up. The schedule should be prepared on a platform that facilitates timely changes, as data and system backup schedules can be very dynamic. Use RPO values to assist with the creation of schedules, as satisfaction of the RPO values will be affected by how frequently their backups are scheduled. Work with the organization's backup software vendor to assist with schedule preparation. The same is true of external resources, such as MSPs and cloud-based backup and storage firms. Figure 1 is an example of a backup schedule.