IT security: backing up

Any organisation that uses computers needs to have a security policy. 

Item 1.0 of the policy should be backups:

1. what to backup ?

2. where to store the backed up data ?

 3. when to backup ?

1. What to backup ? documents; data, including emails and contact lists; device drivers;  application software; hard copy (scanned to hard drive) 

2. Where ? to a backup server on a LAN; removable storage (hard drive, CD, DVD) stored in a safe or off-site; to a remote server via the Internet (cloud computing).

3. When ? Daily/weekly/ ? at end of business/midday ? 

The backup procedure needs to be tested regularly; (monthly?) So does the recovery procedure;

i.e. ensure that whatever has been backed up can be restored in the same state as it was originally.