Back Up Government Data

How to Build a Reliable Backup Strategy  

Work with your IT team to create a reliable strategy that protects your organization from data loss.  

1. Decide what to back up. 

   Start by taking inventory of what important information resides on your network.This will give you an understanding of what you are protecting and who has access. A simple spreadsheet can help you track what you’re backing up.

   Focus on sensitive and operations-critical data such as: 

   • Constituent records  
   • Employee and HR information  
   • Financial and payroll data
   • Emails and critical communications 
   • Configuration files and software settings 
   • Website and operational databases  

   Pay attention to how your data flows at rest and in transit, user behavior and activities and what devices are involved. This gives you a solid baseline for testing, monitoring and security-based decisions.  

   Identify what data your organization can’t operate without—like public safety and emergency services data, public records and legal documents, education infrastructure, critical infrastructure system data—and prioritize those for protection. 
    

2. Follow the 3-2-1 backup rule.

   Once you know what needs to be protected, it’s time to set up your backups. The 3-2-1 rule is a trusted guideline. Protect your data with: 

   • 3 copies of important files
   • 2 different types of storage media (like a hard drive and the cloud)
   • 1 copy stored off-site, away from your location 

   Choose a backup solution that runs automatically and regularly. Regular backups protect against ransomware and malware attacks. Use a combination of on-site and remote backups to protect against threats, hardware failures and physical damage. 
    

3. Secure, test and train. 

   Leverage protections for backups, including physical security, encryption and offline copies. 

   Test backup procedures to make sure your team can rapidly restore data both fully and partially, and to ensure you can roll back data at least seven days if needed. Know how to access critical files even without an internet connection. If using industrial control systems or operational technology (such as for a water treatment plant), conduct a test of manual controls to ensure that critical functions remain operable if the organization’s network is unavailable or untrusted.  

   Finally, ensure your team is trained. A backup plan is only helpful if everyone knows how to use it. Write down your procedures and make sure your team can recover systems, networks and data from your backups. Everyone plays a part in data protection!