An employee discovers that a client’s contracts folder was deleted by mistake two months ago. Backups have succeeded every night, but the software keeps only the last 14 copies, so the copy that had the folder was deleted long ago. A retention policy answers exactly this question: how far back in time can you go?
Why recent copies are not enough
- Late-discovered errors: Accidental deletion or changes to data sometimes come to light weeks later.
- Ransomware and intrusions: The attacker may have been in the network for a while before the attack, so recent copies may also be compromised.
- Gradual data corruption: A file or database that has been slowly corrupted is also corrupted in every recent copy.
- Audit and legal requirements: Some financial and contractual records must be available for years. Confirm the exact period with your company’s financial or legal advisor.
The GFS method
The most common method is GFS (grandfather, father, son), which keeps copies in several time tiers:
- Daily (son): Copies from the last few weeks for everyday restores.
- Weekly (father): One copy from each week, kept for several weeks or months.
- Monthly (grandfather): One copy from each month, kept for a year or more.
- Yearly: If needed, one year-end copy kept for several years.
For example, a “14 daily, 8 weekly, 12 monthly” plan gives about 34 restore points, covering everything from the last two weeks to a year ago. Software such as Veeam and Proxmox Backup Server supports this kind of retention; in Proxmox, with options such as keep-daily, keep-weekly and keep-monthly.
How to set the policy
- Classify your data. The finance database, file server, email and infrastructure servers don’t have the same needs. For example, very old copies of a domain controller are of little use, but old copies of financial records matter.
- Ask the departments. How long does it usually take them to notice deleted or damaged data? Which records must be kept for years?
- Define the tiers. For each category, write down the number of daily, weekly, monthly and yearly copies.
- Estimate capacity. With incremental backups and deduplication, the real footprint is far smaller than “full size times number of copies,” but account for annual data growth too.
- Spread the tiers across different media. Keep daily copies on a fast internal repository, and monthly and yearly copies on an offsite repository or offline media.
Keeping data too long is not free either. Personal data about employees and customers that sits in backups for years without reason is a risk in itself if a breach occurs. Every retention period should have a reason.
Common mistakes
- Using the software’s default settings without thinking about the company’s needs.
- Confusing “number of copies” with “number of days.” If you back up several times a day, 14 copies may cover only a few days.
- Keeping all tiers on a single disk; if it fails, the entire history is lost.
- Not testing old copies. A year-old copy must still be restorable with your current backup software.
- Not documenting the policy. When the person in charge changes, nobody knows why the settings are what they are.
Checklist
- A retention policy for each data category is written and approved.
- You have at least several weeks of daily copies and several months of monthly copies.
- Financial and legal requirements for record retention have been reviewed.
- Long-term copies are also kept offsite or offline.
- Repository capacity matches the retention policy and data growth.
- A restore from an old copy is tested once a year.
A good retention policy balances storage cost against the ability to go back in time. ITPlus724 engineers can design a policy that fits your company’s data and requirements and implement it in your backup software.