Automated database backups scheduled and tested; retention at least 7 days; restore procedure verified

Without automated database backups with at least 7-day retention, a corrupted migration, accidental DELETE without a WHERE clause, or infrastructure failure can result in permanent data loss. SOC 2 A1.2 and NIST CP-9 require backup and recovery capabilities and periodic restore testing. ISO 25010 reliability.recoverability cannot be satisfied by a backup that has never been successfully restored — untested backups have an unknown failure rate.

Enable automated backups with at least 7-day retention. For AWS RDS via Terraform:

resource "aws_db_instance" "main" {
  identifier             = "my-app-db"
  backup_retention_period = 7          # minimum; 14-30 days recommended
  backup_window          = "03:00-04:00"  # off-peak UTC
  # ... other config
}

Document the restore procedure in DEPLOYMENT.md:

## Database Restore
1. AWS Console → RDS → Automated backups → select snapshot
2. Click "Restore to new DB instance"
3. Configure new instance (same instance class as primary)
4. Update DATABASE_URL env var to point to restored instance
5. Promote to primary after validating data integrity

Schedule a quarterly restore test to a throwaway instance to confirm the backup is actually restorable.