Backup and Restore Procedure Template

Backup and restore procedure: data inventory, policy table with 3-2-1 check, jobs, monitoring, step-by-step restore, test evidence log

OperacionesEstándarbackup restore procedureActualizada 20 oct 2026

Abrir en el editorDescargar .md

Cómo usar: Use it for any system whose data must survive deletion, corruption or loss of an account or region. Start with the data inventory and RPO/RTO per data set, then derive the policy. The main pitfall is untested backups; only the restore evidence log in section 6 proves they work.

Vista previa

Backup and Restore Procedure: [System or data set name]

Procedure for backing up and restoring the data of one system or platform: data inventory, backup policy, backup job steps, monitoring, step-by-step restore, restore testing with evidence, and roles. Based on common IT operations practice, including the 3-2-1 backup rule. Replace every [bracketed] value and every row marked Example.

Field	Value
Procedure ID	[BRP-SYSTEM-001]
System	[System name]
Version	[0.1]
Status	[Draft / Approved]
Owner	[@backup-owner]
Last restore test	YYYY-MM-DD
Next review	YYYY-MM-DD
Related	[Disaster recovery plan], [Data retention policy], [Runbook]

1. Scope and data inventory

Data ID	Data set	Store / technology	Size	Classification	RPO	RTO	Owner
D-01	Example: Orders database	PostgreSQL 16, managed	1.3 TiB	Confidential	15 min	4 h	[@name]
D-02	Example: Uploaded invoices	Object storage bucket `invoices-prod`	4.8 TiB	Confidential	24 h	24 h	[@name]
D-03	Example: Infrastructure configuration	Git repository `infra`	200 MB	Internal	0 (Git history)	2 h	[@name]
D-04	Example: Secrets	[Secrets manager]	n/a	Restricted	24 h	1 h	[@name]
[D-nn]	[Data set]	[Store]	[Size]	[Class]	[RPO]	[RTO]	[@name]

Excluded: [list data deliberately not backed up and why, for example "cache cluster, rebuilt from the database on start"].

2. Backup policy

Data ID	Backup type	Frequency	Retention	Primary location	Off-site / second copy	Encryption	Immutable
D-01	Example: Continuous WAL archiving (point-in-time)	Continuous	7 days	Same region, provider-managed	Cross-region copy	AES-256, provider KMS key	No
D-01	Example: Full snapshot	Daily 02:00 UTC	35 days	Same region	Separate backup account, other region	AES-256, dedicated key	Yes, 35-day lock
D-01	Example: Monthly archive	Monthly	13 months	Backup account	Cold storage tier	AES-256	Yes
D-02	Example: Object versioning plus replication	Continuous	90 days of versions	Primary bucket	Replica bucket, other region	SSE with KMS	Yes, object lock
D-04	Example: Encrypted export	Daily	30 days	Backup account	Offline encrypted media, quarterly	Age / GPG, split key custody	Yes
[D-nn]	[Type]	[Frequency]	[Retention]	[Location]	[Copy]	[Method]	[Yes / No]

2.1 3-2-1 compliance

Data ID	Copies	Different media or services	Off-site copy	Immutable or offline copy	Compliant
D-01	3 (live, snapshot, cross-region)	2	Yes	Yes	Yes
D-02	2	1	Yes	Yes	Example: No, add a third copy in other provider by YYYY-MM-DD
[D-nn]	[n]	[n]	[Yes / No]	[Yes / No]	[Yes / No]

2.2 Key management

[Describe where encryption keys are held, who can use them, how they are backed up separately from the data, and how access is reviewed. A backup whose key is lost with the primary account is not a backup.]

3. Backup job steps

3.1 Job: [D-01 daily snapshot]

Item	Value
Scheduler	Example: Provider backup plan `orders-daily`
Schedule	02:00 UTC daily
Configuration source	[Infrastructure code path]
Runs as	[Service account / role]
Expected duration	Example: 25 min

Scheduler triggers snapshot of the database instance.
Snapshot is tagged with data-id=D-01, retention=35d.
Copy job replicates the snapshot to the backup account in [region].
Lock policy is applied to the copied snapshot.
Job writes a success or failure event to the monitoring system (section 4).

3.2 Job: [Data ID and name]

[Repeat for each backup job in section 2: scheduler, source, steps, outputs and verification.]

4. Monitoring and alerting

Check	Condition	Severity	Routes to	Runbook
Job failure	Any backup job reports failure	Ticket, page if two in a row	[Team]	[Link]
Missing backup	No successful D-01 snapshot in the last 26 h	Page	[On-call]	[Link]
Replication lag	Cross-region copy older than 30 h	Ticket	[Team]	[Link]
Size anomaly	Backup size changes by more than 30% day on day	Ticket	[Team]	[Link]
Retention drift	Oldest restorable point younger than policy	Ticket	[Team]	[Link]
[Check]	[Condition]	[Severity]	[Team]	[Link]

A weekly report lists every data set with its latest successful backup and oldest restorable point, reviewed by [@owner].

5. Restore procedure

5.1 Before you start

Confirm the restore request: data set, point in time, target environment, approver.
Open or link an incident or change ticket: [ticket ID].
Check whether the security team must preserve the current state as evidence.
Estimate duration from the last restore test (section 6.2).

5.2 Restore steps: D-01 Orders database (point in time)

Step	Action	Command or location	Verification	Done at
1	Identify target time (UTC) just before the data loss event	Logs, audit trail	Time agreed with data owner	[hh:mm]
2	Restore to a new instance at the target time	`[provider CLI] restore-to-point-in-time --source orders-prod --target orders-restore-[date] --time [timestamp]`	New instance available	[hh:mm]
3	Run integrity checks	`[checksum or row count queries]`	Counts within expected range; latest row timestamp equals target time	[hh:mm]
4	Validate with data owner	Sample of records reviewed	Owner confirms	[hh:mm]
5	Choose switch-over method	Repoint application or copy selected rows back	Decision recorded	[hh:mm]
6	Switch over or merge data	`[command]`	Application healthy; smoke tests pass	[hh:mm]
7	Keep the old instance for [7 days], then delete with approval	[Ticket]	Deletion scheduled	[hh:mm]

5.3 Restore steps: [Data ID and name]

[Repeat for each data set. For object storage, describe restoring a prior object version or copying back from the replica bucket. For secrets, describe the two-person key ceremony.]

5.4 After the restore

Record the restore in the evidence log (section 6.2), even when it was a real event.
Confirm backups resume on the restored system.
Update this procedure with anything that was unclear or slow.

6. Restore testing

6.1 Test schedule

Test ID	Data ID	Test type	Frequency	Next date	Owner
RT-01	D-01	Point-in-time restore to isolated instance plus integrity checks	Monthly	YYYY-MM-DD	[@name]
RT-02	D-02	Restore random sample of 100 objects from replica	Quarterly	YYYY-MM-DD	[@name]
RT-03	D-04	Decrypt and import secrets backup in isolated vault	Twice a year	YYYY-MM-DD	[@name]
RT-04	All	Full restore as part of DR exercise	Yearly	YYYY-MM-DD	[@name]
[RT-nn]	[D-nn]	[Type]	[Frequency]	YYYY-MM-DD	[@name]

6.2 Evidence log

Date	Test ID	Backup used	Restore duration	RTO met	Data verified	Issues	Tester
YYYY-MM-DD	Example: RT-01	Snapshot of YYYY-MM-DD 02:00 plus WAL to 09:15	1 h 52 min	Yes (4 h)	Row counts and checksums match	BR-ISS-03: restore role lacked KMS permission in backup account	[@name]
YYYY-MM-DD	[RT-nn]	[Backup]	[Duration]	[Yes / No]	[Checks]	[Issue IDs]	[@name]

6.3 Issues from testing

ID	Issue	Action	Owner	Due	Status
BR-ISS-03	Example: Restore role lacked key permission	Grant decrypt permission; add to IaC	[@name]	YYYY-MM-DD	[Done]
[BR-ISS-nn]	[Issue]	[Action]	[@name]	YYYY-MM-DD	[Status]

7. Roles and responsibilities

Role	Responsibilities	Person / team
Backup owner	Maintains this procedure, policy and jobs; reviews weekly report	[@name]
Data owner	Sets RPO and RTO; approves restores and validates restored data	[@name]
Operator / on-call	Responds to backup alerts; performs restores	[Team]
Security	Key management, access review, immutability settings	[@name]
Restore approver	Authorises production restores and overwrites	[@name]

Access to delete or shorten retention of backups requires [two-person approval / break-glass role] and is reviewed [quarterly].

8. Review

This procedure is reviewed every [6 months], after each failed or slow restore test, and when a data store is added or changed.

Based on common IT operations practice for backup and recovery, including the widely used 3-2-1 backup rule. Original text written for this collection; commands are illustrative. Template licence: MIT.

Plantillas relacionadas

Operaciones