Offsite Data Backup – How Far Away Is Far Enough?

Introduction

Data backup is an essential part of any business continuity plan. Copying data to an offsite location protects against data loss from events like fires, floods, and ransomware attacks. But how far away should that offsite backup be? This article examines the factors to consider when choosing an offsite backup location.

Onsite vs Offsite Backup

Onsite backups refer to copies of data stored locally, like an external hard drive kept in the same office as the original data. While convenient, onsite backups are vulnerable to the same disasters as the original data.

Offsite backups are copies stored at a different physical location, isolated from potential threats at the primary site. Offsite backup provides an extra layer of protection if something happens to the main office.

Offsite backup is an essential part of the “3-2-1 backup rule”:

• 3 copies of the data
• On 2 different media
• With 1 copy offsite

This ensures redundancy and protects against site-wide failures.

How Far Is Far Enough for Offsite Backup?

When choosing an offsite backup location, distance is important but not the only factor. Here are key considerations:

Distance

The offsite location should be far enough to avoid the same risks as your primary site. For example:

• Different geographic region: Protects against regional disasters like earthquakes, wildfires, floods etc.

• Different power grid: Avoids power outages affecting both sites.

• Different internet provider: Prevents ISP failures interrupting connectivity.

A good baseline is an offsite location at least 10 miles away, in a different city or county, on a separate infrastructure.

Accessibility

The offsite location should be reasonably accessible to retrieve backups if needed. Consider:

• Drive time: How long would it take to physically reach the offsite facility?

• Transport method: Can you easily get backup media to/from the site?

• Bandwidth: Does the offsite facility have sufficient internet bandwidth for quick data transfers?

Ideally the offsite location is close enough for a drive of several hours at most.

Security

Offsite backup media must be properly secured against unauthorized access, theft, tampering, or destruction. Look for offsite facilities with:

• Physical access controls: Restricted entry to the facility and storage areas.

• Security staff: Monitoring for suspicious activity.

• Environmental controls: Protection against fire, water damage, extreme temps etc.

• Encryption: Technological measures like encryption protect data confidentiality.

Cost

Of course, cost is a major factor when choosing services and facilities for offsite backup. Balance the benefits of distance, accessibility and security against the expenses.

Some common offsite backup options ranked by typical cost:

1. External HDD taken home ($)
2. Commercial data vaulting service ($$$)
3. Backup provider’s secondary data center ($$)
4. Cloud storage like S3, Glacier ($-$$)

Recommended Distances for Offsite Backup

Based on the factors above, here are my recommended minimum distances for offsite backup locations:

• Small business: At least 10 miles away, outside your immediate city/town. This protects against localized disasters. An employee’s home could work if properly secured.

• Medium/large business: Over 50 miles away in a different county/region within the state. A commercial data vaulting facility is a good option at this distance.

• Enterprise: Hundreds of miles away in a different state or region. Consider a backup provider’s secondary data center or cloud storage.

• ** regulated industries**: Specific compliance rules may require even greater offsite backup distances of hundreds of miles or out-of-state.

Of course, your business continuity needs and risk tolerance should dictate your ideal offsite backup distance. Performing a business impact analysis is recommended to identify appropriate backup recovery point objectives and recovery time objectives.

Key Takeaways

• Offsite backup distance should isolate your data from risks like fires, floods, and power outages at the primary site.

• Consider distance, accessibility, security, and costs when choosing an offsite backup location.

• Recommended minimum distances are 10-50 miles for small/medium businesses and over 100 miles for large enterprises and regulated industries.

• Business impact analysis helps determine your backup RPOs and RTOs.

• The 3-2-1 backup rule calls for 1 copy of data offsite. Make sure your offsite backup location meets your recovery requirements.

Proper offsite backup is a critical defense against catastrophic data loss. Choosing the right backup distance helps ensure your business can restore operations quickly after a disaster.