ARCHIVE non-changing data permanently to encrypted off-line storage. Store off-site in two locations. Place copies of it on READ-ONLY partitions as well, for fast access, but allow NO changes to this data. Make a fresh copy if you need to change something. This data does NOT need to be backed up, as it is already ARCHIVED.
Similar recommendations omitted for brevity and to reduce the risk someone regards them as a template. This isn't best practice, it is outright dangerous. Where have they come from? Nowhere, they've been trotted out with no reference to the volume or nature of data, regulatory requirements, budgets, user expectations, business needs or any of 101 other factors that should be considered. Without that any backup strategy is fundamentally flawed from the outset.
Archival is a useful tool for some forms of data, a menace that should be disregarded completely for others. It suits datasets that fit into neat little conceptually well-defined boxes of manageable size. The month's transaction data probably suits archival well, your customer database probably doesn't. It's one approach to consider alongside main backup, replication, clerical records etc but if it is advocated at the outset it is wrong by default.
Your main backup strategy is equally flawed - it is premised on the implicit assumption that you can afford to lose a day's data. In many contexts that simply isn't acceptable in this day and age - if you lose an entire day's transactions HMRC will be on you like a ton of bricks. Investors, too, since such a loss will mean you won't get your accounts signed off at year end. Your backup strategy ignores risks like that. Why? Because you never bothered to even consider it.
Even off site storage is not a sure thing 100% of the time. Every time you create a copy of your data, even if encrypted, you are increasing the risk of that data falling into the wrong hands. This risk is multiplied as the data moves off site. The vast majority of the time if you have one copy of the data and add a second then the benefits outweigh the risks, if you already have six copies and add a seventh you are raising the risk for no appreciable benefit. For some particularly sensitive data the thresholds could be lower than that - again it is something to consider before reciting a list of universal recommendations.
You also completely neglect any consideration of human factors, or the time and expense of management and administration. Too many places have technically watertight, appropriate backup policies that fail because of this. If backup takes someone two hours a day it isn't going to get done reliably. Where are your backups then? Again this is something that has to be considered at the outset long before recommendations are made. It's another thing you didn't bother with.
That isn't to say that simple bullet points don't serve a role, if they are factors to consider which will then lead you to actionable points when the particular circumstances have been considered. Taking short cuts does not serve you and here you begin with a fundamental and reckless short cut before you even start.
Biting the hand that feeds IT
