Policy control
- Policy owner
- e.g. Head of Infrastructure
- Approved by
- e.g. IT Director
- Version and date
Backup Policy Template
Most backup policies describe a schedule and stop. The clauses that decide whether you recover from ransomware are the ones usually missing: an immutable copy, an offline or logically-separated copy, and a stated obligation to test restores.
What you get
- Policy text structured on 3-2-1-1-0, with the immutability clause written in
- A per-tier retention and frequency schedule you fill in
- Encryption and key-custody requirements, including where the keys are not stored
- A testing obligation with cadence, so the policy is auditable
How to use this template
- 1
Classify systems into tiers before setting any schedule. A backup policy that treats a payroll database and a print server identically either over-spends or under-protects. Define two or three tiers by business impact and attach frequency and retention to the tier.
- 2
Write the immutability clause explicitly. Ransomware operators target backups first. At least one copy must be immutable or air-gapped, and the policy must say that the account which can delete backups is not the account which administers production.
- 3
State where the encryption keys are not stored. Keys held only on the system being backed up are useless after that system is lost. Name the escrow location and who can retrieve them, and confirm that path is itself tested.
- 4
Make testing an obligation, not an aspiration. Put a cadence in the policy and name the role responsible. A policy that says backups 'should be tested periodically' gives an auditor nothing and gives your team no deadline.
What's inside
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Related templates
More free templates IT teams use alongside this one.
Backup & Continuity
Get templateRestore Test Log
A backup job reporting success proves a file was written. It does not prove the file can be read, is uncorrupted, or contains what you think. This log records the only thing that answers that question: an actual restore, timed and verified.
Backup & Continuity
Get templateRTO / RPO Worksheet
RTO and RPO are usually set by asking the business what it wants, which reliably returns 'zero'. This worksheet sets them the other way round: measure what you can currently deliver, price the gap, and let the business choose knowingly.
Backup & Continuity
Get templateRansomware Recovery Playbook
Ransomware recovery differs from ordinary disaster recovery in one decisive way: the environment you restore into may still be compromised. This playbook sequences containment and credential reset before restoration, so you do not recover twice.
Frequently asked questions
What is the 3-2-1-1-0 backup rule?
+
Three copies of the data, on two different media types, with one copy offsite, one copy immutable or air-gapped, and zero unresolved backup errors. The extra '1' and '0' were added to the older 3-2-1 rule specifically in response to ransomware targeting backup systems.
What should a backup policy include?
+
Scope and explicit exclusions, tiered RPO and retention, the 3-2-1-1-0 requirements including immutability, encryption and key-custody rules, a separation-of-duties clause on who can delete backups, a restore-testing obligation with cadence, and a named owner.
How long should backups be retained?
+
Long enough to cover the time it might take to notice a problem. Thirty to thirty-five daily restore points plus twelve monthly is a common baseline; regulated data may need years. Retention shorter than your detection time means the clean copy is already gone when you look.