'How often should we back up?' is the wrong question in isolation. The right question is 'how much data can we afford to lose, and how long can we be down?' Backup frequency is the answer that falls out of those two decisions.
RPO and RTO in plain terms
- Recovery Point Objective (RPO): the maximum acceptable data loss, measured in time. An RPO of one hour means backups every hour or better.
- Recovery Time Objective (RTO): the maximum acceptable downtime for a system after an incident.
Different systems deserve different RPOs and RTOs. A finance application may justify a fifteen-minute RPO; a static internal wiki may be fine at twenty-four hours.
Typical backup cadences
- Cloud productivity data (Microsoft 365, Google Workspace): several times per day using a third-party backup product.
- Business applications and databases: continuous or hourly, with transaction-log backups for critical databases.
- File servers: hourly to every four hours, depending on change velocity.
- Endpoints: at least daily, with user data on synced storage rather than only on the device.
Retention and testing
Frequency alone is meaningless without retention long enough to detect quiet corruption or ransomware, and without periodic restore testing. A backup you have not restored from is a hypothesis, not a backup.
Practical target
Most SMBs land at hourly backups for critical systems, daily for everything else, with a monthly restore drill and immutable off-site copies retained for at least ninety days.