1. Purpose 

• To define a consistent and effective procedure for backing up critical data and systems within the organisation. 
• To ensure the availability and integrity of critical data and systems in theevent of data loss, hardware failure, or disaster.

2. Scope 

• This procedure applies to all critical data, systems, and applications within the organisation, including on-premises servers, cloud services, and remote systems. 

3. Responsibilities 

• IT department: Responsible for implementing, monitoring, and maintaining the backup process. 
• Data owners: Responsible for identifying and classifying critical data that requires backup. 
• Management: Responsible for approving and overseeing the implementation of the backup procedure. 

4. Backup Schedule 

• Daily backups: Website, Application, Databases
• Weekly backups: Website, Application, Databases
• Monthly backups: Website, Application, Databases

5. Backup Types 

• Full backups: Complete backups of all specified data and systems. 
• Incremental backups: Backups of only the changes made since the last full or incremental backup.
• Differential backups: Backups of only the changes made since the last full backup. 

6. Backup Storage 

• On-site storage: Redundant encrypted private cloud storage.
• Off-site storage: Redundant encrypted private cloud storage.

7.Backup Rotation 

• Short-term retention: 30 days
• Long-term retention: 2 years

8. Backup Testing and Verification 

• Regular testing: Schedule periodic tests of the backup process to ensure data can be successfully restored. 

• Verification: Implement automated tools or manual checks to verify the integrity and completeness of the backups. 

9. Backup Restoration 

• Define a process for requesting and performing data restorations, including roles, responsibilities, and timelines. 

• Maintain documentation of all backup restoration requests and outcomes 

10. Backup Procedure Review and Update 

• Schedule regular reviews of the backup procedure to ensure its effectiveness and alignment with the organization’s needs. 

• Update the procedure as necessary to reflect changes in technology, data  requirements, or organizational priorities.