Cloud Backup and Disaster Recovery Basics: RPO, RTO, the 3-2-1 Rule and Costs

A cloud backup plan answers two questions: how much data can you afford to lose, and how long can you afford to be down? Those answers are your recovery point objective (RPO) and recovery time objective (RTO). Once you set them, choose backups that meet them, keep copies in more than one place, and test restoring on a schedule. Cloud providers make backups easy to switch on, but they do not guarantee that your backups are enough or restorable, because protecting your data is largely your responsibility.

RPO and RTO in plain language

RPO (recovery point objective): the maximum amount of data loss you can tolerate, measured in time. If your RPO is 24 hours, you can lose up to a day of changes, so daily backups are enough. If it is 15 minutes, you need continuous or very frequent backups.
RTO (recovery time objective): the maximum time you can be down. If your RTO is 4 hours, you need a restore process that completes and is verified in under 4 hours.

Tighter targets cost more. An RPO of near zero needs replication or point-in-time recovery, while an RTO of minutes needs a standby environment already running.

Match targets to the business

Ask what an hour of downtime and an hour of lost data costs. For an online store, lost orders and customer trust matter. For a brochure site, a day offline may be tolerable. Set targets per system, because your customer database matters more than your marketing blog.

System	Example RPO	Example RTO	Suggested approach
Brochure website	24 hours	24 hours	Daily backup and a documented rebuild
Online store database	15 minutes to 1 hour	2 to 4 hours	Point-in-time recovery plus tested restore
Internal file storage	24 hours	1 day	Daily backups with versioning
Customer application	Minutes	1 hour or less	Replicated database and standby servers

These are illustrative starting points, not requirements.

The 3-2-1 rule

A widely used guideline for backups:

Keep 3 copies of your data: the live data and two backups.
Store copies on 2 different types of media or storage systems.
Keep 1 copy offsite or in a separate account or region.

In the cloud, this might be: live data on a server disk, daily snapshots in the same account, and a copy in object storage in another region or with a different provider, protected from deletion by a different set of credentials. The separate copy protects you if an attacker, mistake or account problem destroys everything in one place.

Backup types you will see

Snapshots: point-in-time disk copies. Quick and good before changes, but often stored in the same account and region as the original.
Database backups: logical dumps or managed automated backups with point-in-time recovery.
File-level backups: copies of specific folders, with versioning so you can recover older versions.
Image or machine backups: the whole server so it can be recreated.
Immutable backups: copies that cannot be changed or deleted for a retention period, which protects against ransomware and accidental deletion.

What backups cost

Backup storage is usually billed per gigabyte per month, with object storage cheaper than snapshots. Managed database backups often include a free amount equal to the database size and bill beyond that. Cross-region copies add transfer charges.

This is an illustrative example. A company has 300 GB of data. It keeps daily snapshots for 7 days with about 15 percent daily change, which uses roughly 300 + (7 x 45) = 615 GB of snapshot space at 0.05 dollars per GB: 30.75 dollars a month. It also copies a weekly full backup of 300 GB to object storage in another region and keeps four weeks: 1,200 GB at 0.02 dollars per GB: 24 dollars, plus a one-time transfer of roughly 300 GB each week at 0.02 dollars per GB: about 24 dollars a month. Total about 79 dollars a month. Compare that to the cost of losing the business data, and the figure looks modest. The rates are examples only.

Restore testing: the step most people skip

A backup that has never been restored is a guess. Schedule restore tests:

Restore the latest backup to a separate test server.
Start the application and check key data such as recent orders.
Record how long it took, and compare with your RTO.
Fix problems, such as missing files or wrong credentials, and write the steps down.
Repeat quarterly, and after major changes.

Document who does the restore and where the credentials are. In an emergency, you do not want to search for a password.

Disaster recovery plan in one page

Write a short plan that covers:

What systems matter most and their RPO and RTO.
Where backups live and how to access them.
Who is in charge and who to call, including your provider's support.
The step-by-step restore procedure.
How you will communicate with customers if there is an outage.
Where this document is stored so that it is available even if your main systems are down.

Threats backups should cover

Accidental deletion or a bad deployment.
Hardware or provider failures.
Ransomware and malicious deletion.
Account compromise, which is why a copy in a separate account is valuable.
Corruption that is noticed days later, which is why you keep older versions.

Mistakes to avoid

Keeping backups only on the same server or account.
Never testing a restore.
Retaining backups forever and paying for them, or too briefly to notice slow corruption.
Not encrypting backups that contain personal data.
Assuming your provider's backup feature meets legal retention requirements.

Compliance and legal notes

If you hold personal, health or payment data, backups are covered by the same protection duties as live data. Retention rules, such as how long to keep or when to delete records, vary by industry and state. Ask a qualified professional for your situation.

When to consult a professional

Bring in a specialist for regulated data, tight RPO and RTO targets, or when a failed restore would threaten the business. Ask them to run a restore test as part of the engagement.

For first-month steps, see the 30-day setup guide.

Frequently asked questions

Are provider snapshots enough?

They are a good first layer, but keep a separate copy in another account or region to meet the 3-2-1 rule.

How long should I keep backups?

It depends on your recovery needs and legal duties. Many businesses keep daily copies for a few weeks and monthly copies for longer. Confirm any legal requirements.

Does the provider back up my data automatically?

Not by default for most services. Check each service and enable backups yourself.

What is the difference between backup and replication?

Replication copies changes to another system almost instantly, including mistakes and deletions. A backup keeps older versions you can return to.

Sources

Cybersecurity and Infrastructure Security Agency — guidance on ransomware preparedness and backups
National Institute of Standards and Technology — contingency planning publications
Federal Trade Commission — protecting personal information