Data Backup and Recovery: The Controls Most Nigerian Businesses Skip
Most Nigerian businesses have a backup. Most of those backups have never been tested. Most of those untested backups have a failure rate that, if measured, would change the organisation's risk posture immediately. Backup without recovery testing is not backup — it is the appearance of backup.
Disclaimer
This article is for educational purposes only and does not constitute legal, financial, or professional advice. Compliance requirements vary by industry and jurisdiction. Consult a qualified professional for guidance specific to your organisation. Information was accurate at the time of writing — verify current regulations with the relevant authorities.
Data Backup and Recovery: The Controls Most Nigerian Businesses Skip
A Lagos financial services company experienced a ransomware attack in 2024. Their systems were encrypted. Their IT team pointed to the backup server. The backup server had a backup from fourteen months earlier. The intervening fourteen months of transaction, client, and financial records were gone.
This scenario is not unusual. The backup existed. It was outdated because the backup process had silently failed months earlier — a misconfiguration that no one noticed. The IT team had been reporting "backups are running" based on the absence of error alerts, not based on evidence of successful backup jobs.
The controls that most Nigerian businesses skip are not the exotic controls. They are the basic ones: verifying that backups actually completed successfully, testing that backups can actually be restored, validating that restored data is complete and correct.
The RTO/RPO Framework
Two metrics define what backup and recovery means for your business:
RPO (Recovery Point Objective): How much data can you afford to lose? If your RPO is 24 hours, you need daily backups — and you accept that a failure could result in losing up to 24 hours of data.
RTO (Recovery Time Objective): How long can your business operate without the system after a failure? If your RTO is 4 hours, your recovery capability must be able to restore the system to operational within 4 hours of the failure occurring.
Most Nigerian businesses have not defined their RTO and RPO explicitly, which means they have not designed their backup strategy to meet any specific requirement. Define these first, then work backward to the backup architecture that meets them.
Guidance for common Nigerian business contexts:
| System | Suggested RPO | Suggested RTO |
|---|---|---|
| Financial transaction database | 15 minutes | 1 hour |
| Accounting system | 1 hour | 4 hours |
| HR and payroll data | 4 hours | 8 hours |
| Document management | 24 hours | 24 hours |
| 24 hours | 4 hours | |
| Customer data (non-transactional) | 24 hours | 8 hours |
| Website and marketing | 48 hours | 4 hours |
These are starting points, not universal requirements. The company with ₦50M in daily transaction volume has a different financial system RPO requirement than one processing ₦2M daily.
What a Real Backup System Looks Like
The 3-2-1 Rule
The industry-standard minimum for data backup reliability:
- 3 copies of data
- 2 different storage media/types
- 1 copy offsite (and ideally offline)
Applied to a Nigerian business with an on-premises server:
- Copy 1: Production database (primary storage)
- Copy 2: Daily automated backup to a second local drive or NAS (second storage type)
- Copy 3: Daily or weekly automated backup to a cloud storage service (offsite)
A business that backs up to a drive in the same room as the production server fails the offsite requirement — a fire, flood, or theft event removes both copies simultaneously.
Cloud storage options for Nigerian backup:
- AWS S3 (with af-south-1 bucket option for data residency)
- Cloudflare R2 (no egress fees, reliable, global)
- Backblaze B2 (lowest cost per GB, US-based)
- Google Cloud Storage
The choice among these for backup purposes is primarily cost and data residency. Backup data that is compressed and encrypted travels outbound once and is read only during recovery — egress fees matter only at recovery time.
Backup Frequency and Retention
Frequency must match the RPO. If financial data RPO is 15 minutes, full backups every 15 minutes is impractical — the answer is continuous replication (WAL streaming in PostgreSQL, binlog replication in MySQL) combined with periodic full backups.
For most Nigerian business systems (not financial core systems), a practical backup schedule:
- Continuous transaction log backup (if the database supports it — PostgreSQL WAL archiving) for near-zero RPO
- Daily full database backup
- Weekly snapshot retained for 4 weeks
- Monthly snapshot retained for 12 months
- Annual snapshot retained per regulatory requirements
Retention balances storage cost against recovery scenarios. The backup from 7 days ago is useful for catching data corruption or deletions that were not noticed immediately — ransomware that encrypted data 6 days ago and was only discovered today.
The Controls Most Businesses Skip
Backup Completion Verification
A backup job that runs but fails silently — due to a full disk, a network error, a permission change — produces no backup. Without verification that the backup completed successfully and the output is readable, the backup does not exist.
The correct implementation: Every backup job produces a completion event (success/failure) sent to a monitoring system or a central alert destination. Any day without a success event triggers an alert. The IT team sees "Backup: 7 days success" or "Backup: FAILED last night" — not silence.
Monitoring options: Healthchecks.io (a service that accepts a "ping" from successful backup jobs and alerts if the ping does not arrive — simple, $20/month). Custom alerts via email or WhatsApp. Integration with PagerDuty or Opsgenie for critical systems.
Recovery Testing
A backup that has never been tested has an unknown recovery success probability. Common backup failure modes only visible during recovery testing:
- Backup file is corrupted (storage error during write)
- Backup is encrypted with a key that has since been changed or lost
- Backup format is valid but the data is incomplete
- Recovery process takes 18 hours when the RTO is 4 hours
- Restored database requires a missing dependency (specific database version, specific library) that is no longer easily available
The control: Quarterly (at minimum) backup recovery test. In a test environment (not production), restore the most recent backup and verify:
- The restoration process completes without errors
- The restored data is readable and correct (spot-check key records against known values)
- The restoration time meets the RTO
- Any applications that connect to the database function correctly against the restored data
Document the test result, the time taken, and any issues discovered. This is the evidence that a backup programme actually works.
Off-Site and Offline
Two specific failure modes in the Nigerian context:
Power surge and generator events: A surge that destroys a server and a backup drive in the same UPS circuit eliminates both the primary and the backup simultaneously. Off-site backup is insurance against this.
Ransomware: Modern ransomware scans for network-connected backup storage and encrypts it simultaneously with the production data. A backup drive that is always mounted to the server can be encrypted. Offline backup — a drive that is detached after backup and not network-accessible — cannot be encrypted by ransomware. The "air gap" between the backup and the live system is the protections.
Offline backup in practice: an automated script that connects an external drive (via USB or detachable NAS), runs the backup, verifies completion, then unmounts the drive. The drive is physically disconnected until the next backup cycle. This is the control most Nigerian businesses skip because it requires more procedure than a always-connected backup drive.
Cloud-First Backup for Modern Infrastructure
For businesses running applications on cloud infrastructure (Railway, Render, Heroku, AWS, GCP), managed database services provide backup as part of the service:
- Railway PostgreSQL: Automated daily backups, 7-day retention, point-in-time recovery
- Neon: Branching and restore to any point in the trailing history
- AWS RDS: Automated backups with configurable retention (up to 35 days), Multi-AZ replication for high availability
- Supabase: Daily backups, point-in-time recovery on Pro plan
For cloud-managed databases, the backup infrastructure is managed. The remaining responsibilities:
- Verify the backup retention period meets your requirements
- Test restoration periodically (most managed services allow restoration to a new instance without affecting the primary)
- Ensure the cloud provider's backup is in addition to (not instead of) your own independent backup copy
The principle: no single point of failure in the backup strategy. If the cloud provider has an outage that also corrupts backups (rare but documented with some providers), having an independent copy ensures recovery is still possible.
The Business Case for IT Management
Many Nigerian businesses treat backup and recovery as an IT cost rather than a risk management investment. Reframing:
The expected annual cost of a major data loss event for a 100-employee business (combining reconstruction cost, business interruption, contract penalties, customer relationship damage, and regulatory exposure) is typically 5–15% of annual revenue. For a ₦500M revenue business, this is ₦25–75M in expected loss per event.
The annual cost of a robust backup programme — monitoring software, cloud storage, quarterly testing — is typically ₦300,000–₦1,500,000. The insurance premium for an event with ₦25M expected loss, at an occurrence probability of perhaps 2–5% per year, should be substantial. A ₦1.5M backup programme is not an IT expense — it is a cheap insurance policy with a very high payout-to-premium ratio.
Related Articles
- From Reactive to Proactive: Security Automation That Pays for Itself — How to automate the monitoring and alerting that catches backup failures, infrastructure changes, and security incidents before they become data loss events.
- The CFO's Guide to Security ROI: Quantifying Breach Prevention — The financial framework for justifying backup and recovery investment as risk management, using the same annualised loss expectancy model applied here.
- Building a Zero-Trust System on a Startup Budget — The broader infrastructure security architecture that backup and recovery controls fit into, including network segmentation and access controls that limit blast radius.