Backup, recovery, and business continuity. These are the concepts that separate a company that survives a disaster from one that shuts its doors forever. If you are studying for 220-1202, you need to know exactly how to protect data and what to do when the worst happens — because that is what IT professionals get paid to plan for.
Jump to a section
A simple way to picture Backup, Recovery, and Business Continuity
3 copies of your wedding album exist. One sits on your coffee table, one lives in a fireproof safe in your garage, and one is stored at your parents' house in another city. This is not just paranoia — it is a practical plan for when disaster strikes.
Last year, your coffee table copy got a coffee spill that ruined half the pages. You sighed, walked to the garage, and pulled out the second copy. That is your recovery — restoring your photos from a backup. But then, a month later, a burst pipe flooded the garage and destroyed both the coffee table copy you had just replaced and the garage safe copy. If you only had those two, your wedding memories would be gone forever.
Because you stored a third copy at your parents' house in a different city, you still have the photos. That is your business continuity plan — the ability to keep going when a local disaster takes out everything. The 3-2-1 backup rule is exactly this: 3 copies of your data, on 2 different types of media (the album print and the digital scan on a hard drive), with 1 copy kept offsite (your parents' house). The coffee table copy is your primary data. The garage safe is your local backup. The parents' house is your offsite disaster recovery. If your house burns down, you do not lose the photos. That is the whole point of planning for the worst.
Let us start with the most basic idea: a backup is a copy of your data stored in a separate location from the original. If your original file gets deleted, corrupted, or encrypted by ransomware, you can restore it from the backup. This sounds simple, but in practice there are many ways to do it wrong.
The first technical term to understand is RTO and RPO. RTO stands for Recovery Time Objective. This is the maximum amount of time your business can survive without its data. If a hospital loses its patient records, it might have an RTO of five minutes. If a local bakery loses its recipe spreadsheet, it might have an RTO of two days. RPO stands for Recovery Point Objective. This is the maximum age of a backup you are willing to accept. If your RPO is one hour, you can lose at most one hour of data. If your RPO is 24 hours, you accept that you might lose a whole day of work.
There are three main types of backups:
A full backup copies every single file you have selected. It is slow and takes a lot of storage space, but restoring is simple — you just copy everything back.
An incremental backup only copies files that have changed since the last backup (whether that last backup was full or incremental). It is fast and uses little space, but restoring takes longer because you need to restore the full backup first and then apply every incremental backup in order.
A differential backup copies all files that have changed since the last full backup. It is faster than a full backup but slower than an incremental backup. Restoring is easier than incremental because you only need the full backup and the most recent differential backup.
You also need to know where backups are stored. The most common destinations are:
A local backup is stored on a device physically at your location, like an external hard drive or a network-attached storage (NAS) device. It is fast to restore but vulnerable to the same disaster that destroys your primary data.
An offsite backup is stored in a different physical location, such as a cloud service like Microsoft Azure or Amazon Web Services (AWS). This protects against local disasters like fires or floods.
A cloud backup is a specific type of offsite backup where a third-party provider stores your data on their servers. The provider handles the hardware and security.
Now, backup is only half the story. The other half is recovery. Recovery is the process of restoring data from a backup. You need a recovery plan that specifies who does what, in what order, and how long it should take. A disaster recovery plan (DRP) is a documented process for recovering IT systems after a disaster. A business continuity plan (BCP) is a broader plan that covers how the entire business keeps operating — not just the IT systems. For example, if the office floods, the BCP might say employees work from home using cloud-based apps, while the DRP specifies how to restore the server from a cloud backup.
A common technique for business continuity is failover. Failover means automatically switching to a redundant system (a standby copy) when the primary system fails. For example, if your main web server goes down, traffic is automatically redirected to a backup server in another data centre. This is called high availability (HA), and it aims to minimise downtime.
Finally, there is the concept of a backup rotation scheme. This is a schedule for how often you create backups and how long you keep them. The most well-known is the Grandfather-Father-Son (GFS) scheme. 'Son' backups are created daily, 'Father' backups are weekly, and 'Grandfather' backups are monthly. This gives you multiple recovery points over different time periods so you can recover from a problem that may have existed for weeks before you noticed it.
Assess the Business Requirements
Determine the RTO and RPO by interviewing stakeholders. This sets the maximum tolerable downtime and data loss. Without this step, your backup plan will either be too expensive or leave the business exposed.
Choose the Backup Type
Select between full, incremental, or differential backups based on your RTO and RPO. For example, a short RPO (30 minutes) requires incremental backups every 30 minutes, while a long RPO (24 hours) might allow a daily full backup.
Select Backup Destinations
Pick at least two locations: a local destination (external hard drive, NAS, or tape) for fast recovery and an offsite destination (cloud storage or a remote data centre) for disaster protection. This implements the 3-2-1 rule.
Configure Backup Rotation and Retention
Set up a schedule (like Grandfather-Father-Son) that determines how many backups to keep and for how long. This ensures you have multiple recovery points and that old backups are automatically deleted to save space.
Document the Disaster Recovery Plan
Write a clear step-by-step plan for recovery. Include roles, contact information, restore procedures, and verification steps. Store paper copies in multiple locations because digital copies may be inaccessible during a disaster.
Test and Practise the Plan
Run a recovery drill at least quarterly. Time the restore process, identify bottlenecks (like slow internet speeds), and update the plan. Testing reveals flaws that theory never exposes.
Imagine you work as an IT support technician for a small accounting firm with 50 employees. The firm does payroll for local businesses, so they cannot afford to lose even a day's worth of data. Your boss asks you to set up a backup and recovery plan. Here is what you actually do.
First, you assess the firm's RTO and RPO. You talk to the partners and learn that losing more than two hours of pay calculations would be catastrophic, so the RTO is two hours. They could tolerate losing 30 minutes of data at most, so the RPO is 30 minutes. This tells you that you need backups at least every 30 minutes, and you must be able to restore the whole system in under two hours.
Next, you choose the type of backup. You decide to run a full backup every Sunday night when no one is working. Then you schedule incremental backups every 30 minutes during business hours. This way you meet the RPO without using too much storage space.
For storage locations, you configure two destinations:
A network-attached storage (NAS) device in the server room for local backups. This allows fast recovery if a single file gets deleted.
A cloud backup service (like Microsoft Azure Backup) that runs daily and uploads the incremental backups offsite. This protects against a fire or ransomware attack that might encrypt the local backups too.
You also set up the GFS rotation. The daily incremental backups are deleted after 7 days. The weekly full backups are kept for 4 weeks. The monthly full backups are kept for 12 months. This covers both short-term recovery and long-term archival needs.
Now you need a disaster recovery drill. You schedule a quarterly test where you simulate a server failure. You practise restoring the entire payroll system from the cloud backup to a spare server. You time it: the first time it takes 4 hours. You find that the bottleneck is downloading the full backup from the cloud — the internet connection is too slow. So you recommend upgrading to a faster business-class fibre line. After the upgrade, you get it down to 1.5 hours, within the RTO.
Finally, you document everything. You write a simple one-page disaster recovery plan that says:
If the server fails, go to step 1: notify the IT manager.
Step 2: switch to the cloud-based backup server (a redundant system you set up).
Step 3: call the cloud provider if the backup restore fails.
Step 4: verify data integrity by comparing a sample of yesterday's payroll records.
You put this document on a shared drive and print two copies — one in the server room and one in the managing partner's office. Because if the network is down, you cannot access the shared drive. That is a beginner mistake you avoid.
The 220-1202 exam tests backup, recovery, and business continuity heavily. You will see scenario-based questions where you must choose the correct procedure given a specific disaster. The CompTIA exam loves to distinguish between terms that sound similar but mean different things. Here is what you need to memorise:
Full backup vs incremental vs differential: Know the speed, space, and restore time trade-offs. The exam will give you a scenario like 'A company needs a backup method that uses the least storage space each night' — the answer is incremental.
RTO vs RPO: The exam will define one and ask for the other. RTO is about time to recover; RPO is about how much data you can lose. They often pair these in a single question.
Onsite vs offsite vs cloud backup: The exam expects you to know that offsite and cloud backups protect against local physical disasters. A question might say 'The server room flooded. Which backup still works?' The answer is the offsite or cloud backup.
Disaster recovery plan (DRP) vs business continuity plan (BCP): The exam will ask you to identify which plan covers what. A BCP is broader and includes non-IT procedures like working remotely. A DRP is specifically about restoring IT systems.
Failover vs backup: Failover is automatic and instant (like a spare server taking over). Backup requires manual restore. The exam loves to test this distinction.
Types of backup destinations: Know the difference between a tape drive, external hard drive, NAS, cloud storage, and optical disc (like a DVD). The exam may ask which is most appropriate for a given budget or security need.
Backup rotation schemes: The Grandfather-Father-Son scheme is a favourite. The exam may describe a rotation schedule and ask you to name it.
3-2-1 rule: Remember 3 copies, 2 different media types, 1 offsite. This is a common exam answer for best practices.
The traps CompTIA sets include:
Confusing RTO with RPO. Read carefully: if the question mentions 'maximum tolerable data loss', that is RPO. If it mentions 'maximum time to restore', that is RTO.
Thinking that a cloud backup is always better than a local backup. The exam will point out that cloud backups depend on internet speed, so for fast recovery, a local backup is better.
Assuming that a backup automatically means you are safe from ransomware. The exam will remind you that modern ransomware can encrypt backups too if they are connected to the network. The solution is an immutable backup or an air-gapped backup (one that is physically disconnected when not in use).
Thinking that a disaster recovery plan is the same as a business continuity plan. The exam explicitly tests the difference.
Memorise these key definitions:
Immutable backup: a backup that cannot be changed or deleted, even by an admin, for a set period.
Air gap: physically disconnecting a backup from the network to prevent malware from reaching it.
Snapshots: a point-in-time copy of a virtual machine's state, used for quick recovery.
Bare-metal restore: restoring an entire system (operating system, applications, data) onto new hardware.
File-level restore: restoring only specific files from a backup.
Always follow the 3-2-1 backup rule: three copies of your data, on two different types of media, with one copy stored offsite.
Recovery Time Objective (RTO) defines the maximum time a business can survive without its systems; Recovery Point Objective (RPO) defines the maximum data loss it can tolerate.
Incremental backups save only changed data since the last backup, making them fast and space-efficient but slower to restore than differential backups.
A disaster recovery plan (DRP) focuses specifically on restoring IT systems, while a business continuity plan (BCP) covers keeping the whole organisation operational.
Failover is automatic and immediate switching to a redundant system, whereas recovery from a backup requires manual steps and takes time.
Immutable backups and air-gapped backups protect against ransomware because they cannot be modified or deleted by an attacker.
The Grandfather-Father-Son backup rotation scheme provides daily, weekly, and monthly recovery points to cover short-term and long-term data restoration needs.
Always test your backups regularly — an untested backup is as good as no backup at all.
These come up on the exam all the time. Here's how to tell them apart.
Full Backup
Copies all selected files every time
Takes the longest time and most storage space
Simplest to restore — only one step
Incremental Backup
Copies only files changed since last backup
Takes the shortest time and least storage space
Requires restoring the full backup plus every incremental backup in order
Recovery Time Objective (RTO)
Measures how fast you need to restore service
Specified in hours or minutes
If you exceed RTO, the business suffers significant loss
Recovery Point Objective (RPO)
Measures how much data you can afford to lose
Specified in time (e.g., 1 hour of data)
If you exceed RPO, you lose more data than acceptable
Disaster Recovery Plan (DRP)
Focuses only on IT systems and data
Covers restoring servers, networks, and applications
Includes steps for recovering from a cyberattack or hardware failure
Business Continuity Plan (BCP)
Covers the entire organisation, not just IT
Includes relocating staff, supplier communication, and customer support
Ensures the business can continue operating even without full IT recovery
Cloud Backup
Stored on third-party servers via the internet
Protected from local disasters like fire or flood
Restoration speed depends on internet bandwidth
Local Backup
Stored on a device physically at your location
Vulnerable to the same local disasters as primary data
Restoration is typically much faster due to direct connection
Failover
Automatic and immediate switch to a redundant system
No data loss if systems are synchronised
Used for high-availability systems like web servers
Backup Restore
Requires manual steps to restore data from a backup
Often results in some data loss depending on RPO
Used when primary data is corrupted or destroyed
Mistake
A single backup in a different folder on the same hard drive is sufficient.
Correct
A backup must be on a separate storage device or location, because a single hard drive failure will destroy both the original and the backup if they are on the same drive.
Many beginners think 'backup' just means making a copy, but they do not consider hardware failure. It is an intuitive shortcut that leads to false security.
Mistake
Cloud backups are always faster to restore than local backups.
Correct
Restoring from the cloud is usually slower because it depends on internet download speed. Local backups (like an external hard drive) can be restored much faster.
People assume 'the cloud' is magic and fast. In reality, downloading terabytes of data over a typical business internet connection takes hours or days.
Mistake
RTO and RPO are the same thing.
Correct
RTO is the time allowed to restore service; RPO is the maximum age of data you can lose. They measure completely different things.
Both are three-letter acronyms starting with 'R' and both involve time. Beginners often merge them into one fuzzy concept.
Mistake
Once you have a backup, you are fully protected against ransomware.
Correct
If the backup is connected to the network and writable, ransomware can encrypt it too. You need immutable or air-gapped backups for true protection.
It is comforting to believe a single backup is enough. Beginners do not think about what happens when the attacker's malware is sophisticated enough to find and encrypt the backups.
Mistake
A business continuity plan is only about IT systems.
Correct
A BCP covers all business operations, including non-IT aspects like relocating staff, communicating with customers, and sourcing raw materials. IT recovery is just one part.
The term 'business continuity' sounds technical, so beginners assume it is IT-only. In reality, it is a business-wide concept that IT supports.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A full backup copies all selected files every time, taking more time and space. An incremental backup only copies files that have changed since the last backup (full or incremental), making it faster and smaller but requiring all previous increments to restore.
Cloud backups are generally safe because providers encrypt data and replicate it across multiple data centres. However, they are only as secure as your password and access controls. Always enable multi-factor authentication (MFA) for cloud backup accounts.
At least once a quarter, but ideally monthly for critical systems. Testing verifies that the backup is not corrupted and that your restore procedure works. Untested backups have a high chance of failing when you need them most.
It is a best practice: keep 3 copies of your data (1 primary and 2 backups), store them on 2 different types of media (like a hard drive and the cloud), with 1 copy stored offsite to survive local disasters.
Yes, if the backup is connected and writable. To protect against this, use immutable backups (cannot be changed) or air-gapped backups (physically disconnected when not in use), and store backup software credentials separately from the primary network.
A disaster recovery plan (DRP) covers restoring IT systems after a disaster. A business continuity plan (BCP) is broader and includes non-IT processes like relocating staff, rerouting supply chains, and communicating with customers.
You've finished Backup, Recovery, and Business Continuity. Continue through the 220-1202 study guide to build a complete picture of the exam.
Done with this chapter?