Protect hybrid-cloud data by setting recovery objectives for each workload, inventorying its data and dependencies, keeping protected copies across separate security and failure boundaries, and proving the restore process with regular tests. A successful backup job shows that data was copied; only a representative restore test shows whether the data and the systems that need it can be recovered in time.
Start with the recovery outcomes each workload needs
Before choosing a service or schedule, agree with the business owner on two measures for every workload:
As an Amazon Associate I earn from qualifying purchases.
- Recovery point objective (RPO): the maximum acceptable time between the incident and the last recoverable data point—in other words, how much recent data the business can afford to lose.
- Recovery time objective (RTO): the maximum acceptable delay between an interruption and restoration of the service.
These objectives are workload-specific. A database that processes frequent transactions may need a tighter RPO than an archive, while a service that must return quickly may need prepared recovery capacity rather than a restore that starts from cold backup. There is no universal backup interval that meets every workload’s objectives.
Inventory data, dependencies, and recovery needs
Build one inventory across data centers, edge locations, and cloud accounts or subscriptions. Include more than bulk files: configuration, identity and access dependencies, encryption-key dependencies, and application components may all be needed to make restored data usable.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Record for each workload | Why it matters |
|---|---|
| Owner, location, and data classification | Identifies who approves recovery and which systems and copies are in scope. |
| Application, database, and infrastructure dependencies | Shows what must be recovered together, and in what order, for the service to work. |
| RPO, RTO, and required restore granularity | Connects business impact to protection frequency, recovery capacity, and whether recovery must be at file, object, database, application, volume, or whole-instance level. |
| Change rate and data volume | Helps assess protection frequency, transfer needs, storage consumption, and recovery duration. |
| Retention, jurisdiction, and contractual requirements | Guides where copies may be stored and how long they must remain available. |
| Recovery destination and validation owner | Clarifies where to restore and who will confirm that the recovered data and application are correct. |
Use the inventory to identify gaps: a workload with no named owner, no agreed objectives, or an unknown recovery dependency is not ready for a reliable recovery plan.
Choose a protection cadence from the RPO
Once an RPO is agreed, choose a backup schedule or continuous-protection approach that can meet it under real operating conditions. A shorter RPO generally requires more frequent or continuous capture, but frequency alone is not proof that a usable recovery point exists. Confirm that the chosen method captures consistent data for the workload and that the recovery point can be selected and restored.
Set retention according to business, legal, and contractual needs, while accounting for storage and transfer costs. Test that the retention policy leaves recovery points available for the incidents it is meant to address, such as delayed discovery of corruption. The right cadence and retention period depend on the workload, change rate, jurisdiction, objectives, and budget; technical guidance does not establish one schedule for all hybrid environments.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Keep backup copies beyond production’s failure boundary
Backups should not depend on the same access and security controls as production. If an attacker, mistaken administrator, or compromised account can delete both live data and its backups, the copy may not help. Use encryption and tightly scoped permissions, and consider separate accounts, subscriptions, administrative controls, or isolated storage where appropriate to the threat model. Protect the credentials and keys needed for recovery without giving routine production access unrestricted control over backup copies.
Microsoft Azure’s security guidance describes a 3-2-1-1 approach: keep three copies in total (the production copy and two backups), use two media types, keep one copy offsite, and retain one immutable and isolated copy. This is Microsoft’s guidance, not a universal regulatory mandate. Apply the underlying idea to the estate: maintain recoverable copies across suitable media and locations, and make at least one copy difficult to alter or delete from the production security boundary.
For a hybrid environment, consider whether a local control-plane failure, account compromise, or regional disruption could affect both production and recovery. Cross-account, cross-subscription, or cross-region copies can provide another recovery path when supported and appropriate, but their access, data location, retention, and restoration behavior must be part of the design. An offline removable drive can be one element of a multi-copy strategy only when secure handling, rotation, encryption, retention, and restore procedures are defined; it is not a complete hybrid backup plan by itself.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Select tools against the estate, not the brand name
Cloud-native services and third-party platforms can each be part of a hybrid design. AWS Backup and Azure Backup are examples, not an exhaustive comparison or a recommendation for every organization. AWS’s hybrid guidance discusses options for Outposts, including EBS snapshots, S3 versioning and replication, and third-party backup solutions. Azure Backup documentation covers Azure services and on-premises workloads, including protections and recovery options. Actual support varies by workload, region, and service, so check the current support documentation for the exact environment before relying on a feature.
| Approach | What to verify |
|---|---|
| Cloud-native backup service | Whether it covers the exact on-premises, edge, and cloud workloads; which recovery granularities and destinations it supports; and how isolation, retention, and cross-region recovery work. |
| Third-party hybrid platform | Whether it supports the estate’s hypervisors, databases, applications, and cloud accounts; where backup data and metadata reside; and which identities can administer or delete copies. |
| Mixed design | How policies, monitoring, restore procedures, and ownership fit together across tools—and whether the combined design introduces gaps or conflicting retention rules. |
For each candidate, compare workload coverage, achievable RPO and RTO, restore granularity, recovery destinations, cross-boundary options, encryption and immutability controls, data residency, retention, operational complexity, test automation, and storage, transfer, and recovery costs. A feature list is not enough: confirm that the required recovery path works for the precise workload and destination.
Write a runbook for the failure you actually need to recover from
Define separate procedures for ordinary data loss and for events that may compromise the normal recovery environment. A deleted file may call for a granular restore; ransomware or account compromise may require selecting a known-clean point and restoring through an isolated or separate security boundary. A regional outage may require a different destination than a local system failure.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Scenario | Recovery path to plan |
|---|---|
| Accidental deletion or overwrite | Find a suitable point-in-time recovery point and restore the affected file, object, database, or other supported granularity. Validate it with the data owner. |
| Corruption discovered later | Identify a clean recovery point from before the corruption began, then check dependent data and application consistency before returning it to service. |
| Ransomware or account compromise | Use an isolated or cross-boundary path where available, select a clean point, and ensure the compromised production credentials cannot also control the recovery copy. |
| Infrastructure or regional disruption | Restore or fail over to a planned alternate destination, and account for the capacity, access, dependencies, and data location required there. |
For every scenario, the runbook should name the incident decision-maker, the person authorized to select a recovery point, the required keys and credentials, the destination, dependency order, validation owner, and the criteria for resuming service. Include how access to recovery credentials is regained if ordinary identity services are unavailable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test restores and measure the result
Test more than whether a backup job completes. Exercise the relevant recovery granularities: a file or object, an application or database with consistency checks, and a full workload where risk and objectives justify it. Include isolated or cross-boundary restoration in testing when ransomware or account compromise is in scope. Record elapsed recovery time, the recovered point’s age, errors, and the application owner’s validation; compare the results with the workload’s RTO and RPO.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set the test scope, method, and frequency according to risk and recovery objectives. A full restoration of every workload on every test may be impractical, but untested dependencies and paths remain unproven. AWS’s hybrid guidance identifies successful periodic recovery tests as a desired outcome. Microsoft’s security benchmark recommends defining test scope, frequency, and method. NIST’s June 2026 operational-technology guidance also emphasizes creating backups, testing them, and reviewing them during recovery exercises.
- Choose a workload and scenario. Select a representative recovery path and state the RPO and RTO it must meet.
- Use a controlled destination. Restore to an approved test environment, isolated when the scenario involves compromise, rather than overwriting production by default.
- Recover dependencies. Follow the runbook for access, keys, configuration, and application components as well as the data itself.
- Validate with the owner. Confirm data integrity and application behavior using checks appropriate to that workload.
- Compare and remediate. Record the observed recovery point and elapsed time; resolve gaps in access, capacity, instructions, or dependencies before treating the plan as ready.
Review the design when the environment changes
Revisit the inventory and recovery plan when workloads move between on-premises systems and cloud, when accounts or regions change, when data classification or retention obligations change, or when application dependencies are updated. Recheck provider support for the exact workload and geography, and repeat restore tests after material changes to backup policies, identities, or recovery destinations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
