Cyber Resilience FAQ: Backup, Retention, Recovery

This FAQ answers the core questions about cyber resilience: what backup retention periods and recovery time objectives (RTOs) you should set, how often to test restores, and how to balance cost against data loss risk. You’ll get clear definitions, practical planning numbers, and testing guidance you can apply immediately.

Formula

Availability = 100 × (1 − RTO ÷ (24 × 365))

RTO as % of MTD = 100 × RTO ÷ MTD

Where:

• RTO (Recovery Time Objective) – the maximum time you can afford to be down after an incident, in hours.
• RPO (Recovery Point Objective) – the maximum age of data you can lose, in hours. It equals the maximum data loss per incident.
• MTD (Maximum Tolerable Downtime) – the total outage time that would seriously harm the business, in hours.

Worked Example

Using the default values: RTO = 4 hours, RPO = 24 hours, MTD = 24 hours.

Availability = 100 × (1 − 4 ÷ 8760) = 100 × (1 − 0.0004566) = 99.9543%

RTO as % of MTD = 100 × 4 ÷ 24 = 16.7%

Max data loss = 24 hours.

So with a 4-hour RTO, the system must be restored within 4 hours, and you can lose at most 24 hours of data (your backups must be taken at least every 24 hours).

What Is Cyber Resilience?

Cyber resilience is the ability to keep operating and recover quickly after a cyber incident—like ransomware, a destructive malware attack, or a data breach. It goes beyond traditional backup because it assumes an attacker may try to delete, encrypt, or corrupt your backups too. A resilient strategy includes offline or immutable backups, tested recovery procedures, and clear recovery time and recovery point targets.

Backup Retention: How Long to Keep Backups

Retention is how long you keep a backup copy. There is no single “right� number; it depends on regulations, business needs, and the risk of ransomware. Common practice is a tiered approach:

• Daily backups – keep 7 to 35 days (a week to a month).
• Weekly backups – keep 4 to 8 weeks (a month to two months).
• Monthly backups – keep 6 to 12 months.
• Yearly backups – keep 3 to 7 years for compliance or legal reasons.

Also consider the “3-2-1 rule�: three copies of your data, on two different media, with one copy offsite. In a ransomware context, many experts add “1-0� – one copy offline or immutable, and zero errors in restore testing.

Recovery Time Objective (RTO) and Recovery Point Objective (RPO)

RTO is the maximum time your systems can be down after an incident. RPO is the maximum age of data you can afford to lose. For example, an RPO of 24 hours means you can lose up to a day of changes; you must back up at least daily. An RTO of 4 hours means you must be able to restore critical systems within 4 hours.

Set RTO and RPO per system, not globally. A customer-facing e-commerce site might have RTO of 1 hour and RPO of 15 minutes. An internal file server might have RTO of 8 hours and RPO of 24 hours. Your MTD (maximum tolerable downtime) is the total outage that would be unacceptable; your RTO should be less than MTD, usually 50% or less, to leave room for unexpected delays.

Recovery Testing: How Often and How to Do It

Testing is the only way to know your backups actually work. A backup that has never been restored is not a backup – it’s a hope. Best practice is to test:

• Quarterly – full restore of at least one critical system.
• Annually – full disaster recovery exercise that includes all critical systems and involves the actual recovery team.
• After any major change – new software, new backup tool, or new infrastructure.

Test types:

• File-level restore – restore a few files from a backup to verify integrity.
• Application-level restore – restore a database or application to a test environment and verify it works.
• Full disaster recovery – fail over to a secondary site or cloud and run operations from the restored environment.

Document the test results, including time to restore and any failures. Use that data to adjust your RTO and RPO if you can’t meet them.

Common Problems and Misconceptions

• “We have backups, so we’re safe.â€� – Backups are only safe if they are tested and stored in a way that survives ransomware. If your backups are on the same network and accessible with the same credentials, an attacker can delete them.
• “RPO equals backup frequency.â€� – Yes, but only if the backup is successful and the data is consistent. If a backup fails silently, your real RPO is longer.
• “RTO is just about restoring data.â€� – It also includes time to spin up servers, reconfigure network, and get users back in. Many recovery plans underestimate this.
• “Testing once a year is enough.â€� – A year is a long time; systems change, and a problem discovered during a real incident is too late. Quarterly testing is a common minimum.

How to Choose Your Targets

Start by classifying your systems by criticality:

1. List all systems and data.
2. For each, ask: “If this is down for 1 hour, 1 day, 1 week, what is the impact?�
3. Set MTD for each system based on that impact.
4. Set RTO to 50% or less of MTD.
5. Set RPO based on how much data loss is tolerable – often driven by financial loss or legal requirements.
6. Choose backup frequency that meets RPO (e.g., RPO of 24h → daily backup; RPO of 15 min → continuous replication).
7. Choose recovery technology that can meet RTO (e.g., on-premises restores vs. cloud failover).

Remember to include time for detection and decision-making. If you discover the attack at 2 AM and it takes 2 hours to declare an incident, that time counts against your RTO.

Cost and Safety Considerations

Shorter RTO and RPO cost more: more frequent backups, faster storage, replication, and more testing. A common approach is to set aggressive targets for a small set of “tier 1� systems and relaxed targets for the rest. Safety also means protecting backups themselves:

• Use immutable backups (write-once-read-many) or store a copy offline.
• Separate backup credentials from production credentials.
• Encrypt backups at rest and in transit.
• Monitor backup jobs for failures and alert on missed backups.

Also consider the human factor: ensure you have runbooks and trained staff. An untested plan is just a document.

Frequently Asked Questions

What is the difference between RTO and RPO?

RTO (Recovery Time Objective) is the maximum time your systems can be down after an incident. RPO (Recovery Point Objective) is the maximum age of data you can afford to lose. RTO is about time to recover; RPO is about data loss. For example, RTO of 4 hours means you must be back up within 4 hours; RPO of 24 hours means you can lose at most 24 hours of data.

How often should I test my backups?

At least quarterly for critical systems, and annually for a full disaster recovery exercise. Also test after any major change to your infrastructure or backup tool. Regular testing ensures you can actually restore when needed.

What is a good backup retention period for ransomware protection?

There is no one-size-fits-all, but a common strategy is to keep daily backups for 30 days, weekly for 8 weeks, and monthly for 12 months. This gives you multiple restore points to recover from before an infection spread. Keep at least one copy offline or immutable to resist ransomware.

Can I meet an RTO of 1 hour with daily backups?

Yes, if your recovery process is fast enough. RTO is about time to restore, not backup frequency. However, if you need to restore to a point very close to the incident, you may need more frequent backups or continuous data protection. Daily backups mean you could lose up to 24 hours of data, which may be acceptable for some systems.

What is the 3-2-1 backup rule?

It means you have three copies of your data, on two different types of media, with one copy offsite. For example, your production data, a local backup on a NAS, and a cloud backup. This protects against hardware failure, local disasters, and ransomware (if one copy is offline or immutable).

Related

• Choosing Sampling Rates & Filters for Motion Sensors
• Mortal Shell 2 Disciple’s Grotto Walkthrough
• Gemini AI Returns: Can It Handle Online Orders?

in rto | Recovery Time Objective (RTO) | hours | 4 | 0
in rpo | Recovery Point Objective (RPO) | hours | 24 | 0
in mtd | Max Tolerable Downtime | hours | 24 | 0
out availability | Required availability | % | 100 * (1 - rto / (24 * 365)) | 6
out rto_vs_mtd | RTO as % of MTD | % | 100 * rto / mtd | 1
out max_data_loss | Max data loss per incident | hours | rpo | 0