Backup and Data Recovery – Business Continuity and Data Protection

Backup and data recovery — business continuity strategy for organisations compliant with NIS2, ISO 27001 and DORA

A backup is not a single cron job on a file server — it is a designed disaster recovery strategy in which every technical decision follows from a business impact analysis. The starting point is two parameters: RPO (Recovery Point Objective), meaning how much data the organisation can afford to lose in the event of a failure, and RTO (Recovery Time Objective), meaning how long service restoration can take. These numbers determine the technology choices: snapshot frequency, synchronous or asynchronous replication, copy location and restore method.

The recommended industry standard is the 3-2-1 rule — three copies of data, on two different media, one copy at a location separate from production. In 2026 we extend this model to 3-2-1-1-0 with an additional immutable copy (ransomware-resistant) and a requirement for zero restore errors in tests. Immutability is achieved through object lock in S3, Veeam Hardened Repository or Synology WORM — so even if an attacker encrypts the production environment, the backup copies remain intact.

Virtline designs, deploys and maintains backup solutions for on-premises, cloud and hybrid environments — with emphasis on repeatable restore tests and mapping controls to NIS2, ISO 27001 and DORA requirements. We serve clients in the financial sector, healthcare, public administration and manufacturing, for whom production downtime means measurable losses or a breach of regulatory obligations.

Backup technologies — proven vendor platforms

We are not tied to a single vendor. We select the solution to match the client’s scale, budget and regulatory requirements. In our deployment practice we most often work with:

 Veeam Backup & Replication — enterprise backup market leader, support for VMware, Hyper-V, AWS, Azure, M365, immutable repositories and Veeam Hardened Repository on Linux.

 Acronis Cyber Protect Cloud — integrates backup with anti-malware protection and AI-based ransomware detection, well suited to SMEs and managed service providers (MSP).

 Synology Active Backup for Business — cost-effective all-in-one solution for SMEs with native support for M365, hypervisors and workstations, plus WORM for immutable copies.

 QNAP HBS 3 / NetBak — backup to QNAP NAS arrays with cloud replication, snapshots and WORM protection — a good choice for organisations with existing NAS infrastructure.

 Carbonite Endpoint / Server — endpoint and physical server backup for organisations without a dedicated backup server, with automatic replication to Carbonite cloud.

 S3-compatible object storage — AWS S3, Azure Blob, Wasabi, MinIO with object lock enabled as the immutable tier for the 3-2-1-1-0 strategy.

How we design backup — 4 implementation stages

A backup implementation does not begin with software installation — it begins with a conversation about what “failure” means for the business. Each stage ends with a concrete deliverable, from the RPO/RTO matrix to the first successful test restore.

1. Business impact analysis (BIA) and backup policy — workshops with the client, establishing system criticality, RPO/RTO parameters for each application, legal retention requirements (accounting, personal data, medical records) and drafting a backup policy as a document compliant with ISO 27001 A.8.13.

2. Architecture design — technology selection (Veeam, Acronis, Synology, QNAP), 3-2-1 topology design, repository locations (on-premises, secondary site, cloud), immutable layer, capacity estimation and backup window planning.

3. Deployment and configuration — repository installation, job configuration, encryption, compression and deduplication setup, monitoring integration (Zabbix, PRTG, SIEM), client administrator training.

4. Restore tests and DR runbook — first full test restore of a critical application, disaster recovery runbook development, setting up a schedule for recurring tests (quarterly or biannually) and KPIs reported to management.

Backup in NIS2, ISO 27001 and DORA requirements

Backup and recovery is an area explicitly named in three key regulations relevant to European businesses. Lack of a documented policy and test evidence means non-compliance and the risk of sanctions.

• NIS2 art. 21(2)(c) — business continuity and backup management. Essential and important entities must implement backup policies, business continuity and disaster recovery plans (BCDR) and crisis management. The NIS2-implementing national legislation maintains this requirement in full.
• ISO/IEC 27001:2022 A.8.13 — Information backup. The organisation must maintain backup copies of information, software and system images, test them regularly and retain them according to an agreed retention policy.
• ISO/IEC 27001:2022 A.5.30 — ICT readiness for business continuity. Requires planning, implementing, maintaining and testing ICT readiness to ensure business continuity — directly linked to RTO/RPO and DR tests.
• DORA art. 11 — backup policies and procedures. Financial entities must implement backup policies and procedures covering data scope, frequency, storage method and recovery procedures.
• DORA art. 12 — ICT business continuity and recovery procedures. Requires the ability to quickly, securely and completely restore data with minimal downtime and periodic testing of recovery plans.
• GDPR art. 32 — security of processing. The controller must ensure the ability to rapidly restore the availability of personal data in the event of a physical or technical incident — in practice implemented through backups and disaster recovery.