# Environment risks, backup and business continuity

*Platform Development Lifecycle and Deployment Architect Study Guide · Planning · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-development-lifecycle-and-deployment-architect/planning/environment-risks-backup-and-business-continuity*

Which environment risks an architect must plan for and how to mitigate each: coordinated multi-system releases with additive changes, data backups that metadata rollback cannot replace, tested restores, kept pipeline artifacts, capacity and load testing before peaks, deployment windows with notice and post-deploy checks, and continuity plans for communication and vendors.

- Certification: Salesforce Platform Development Lifecycle and Deployment Architect
- Exam section: Planning
- Study guide: https://www.certifyforce.com/study-guide/platform-development-lifecycle-and-deployment-architect

**Official exam objective:**

> Understand customer environment risks and articulate appropriate mitigation strategies.

## What the exam expects

- Recommend a backup and restore strategy that separates metadata (restored by redeploying from source) from record data (restored only from a backup taken before the change), and test restores on a schedule.
- Mitigate cross-system release risk with coordinated releases, compatibility testing and additive interface changes.
- Plan business continuity for people, communication channels and vendor dependencies.
- Reduce release risk with kept pipeline artifacts, capacity projection, production-scale load tests, deployment windows, stakeholder notice and post-deployment checks.

Key terms: **RTO** (maximum acceptable downtime after a failure); **RPO** (maximum acceptable data loss, measured in time); **additive change** (adding a field or element instead of renaming or removing one); **build artifact** (the deployment package, test results, scan reports and logs a pipeline run keeps); **deployment window** (a planned low-usage period for a release).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Metadata rollback | Redeploy the previous version; no native rollback command | [Operational Excellence](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence.html) |
| Data changes | Need a pre-deployment backup to restore | [Operational Excellence](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence.html) |
| Recycle Bin | Holds deleted items, not prior values of updated records | [Recycle Bin](https://help.salesforce.com/s/articleView?id=sf.home_delete.htm&type=5) |
| Data Export cadence | Every 7 days (weekly export) or 29 days; files need their own options; zips deleted after 48 hours; not in sandboxes | [Export Backup Data](https://help.salesforce.com/s/articleView?id=sf.admin_exportdata.htm&type=5) |
| Backup frequency | Set by RPO; daily backup gives a 24-hour RPO; native export has no point-in-time restore | [Reliability](https://architect.salesforce.com/docs/architect/well-architected/guide/reliability.html) |
| Restore validation | Quarterly, into scratch orgs or developer sandboxes | [Reliability](https://architect.salesforce.com/docs/architect/well-architected/guide/reliability.html) |
| Pipeline artifacts | Keep packages, test results, scan reports and logs | [DevOps Patterns](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence-devops-patterns.html) |
| Concurrent refreshes | Processed in series, not parallel | [Sandbox Best Practices](https://help.salesforce.com/s/articleView?id=000387743&language=en_US&type=1) |
| SandboxPostCopy | Runs as the Automated Process user, which lacks access to some objects | [SandboxPostCopy](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_System_SandboxPostCopy.htm) |
| Post-deployment watch | Smoke tests, then enhanced monitoring for 24-48 hours | [DevOps Patterns](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence-devops-patterns.html) |

## Check yourself

- Why does a release that bulk-updates records need a backup even when every version is tagged in Git?
- When is a backup trustworthy?
- Why do several sandbox refreshes started together appear stuck?
- What should stakeholders hear before a deployment window?

## Sources

- [Reliability | Well-Architected Framework](https://architect.salesforce.com/docs/architect/well-architected/guide/reliability.html)
- [Operational Excellence | Well-Architected Framework](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence.html)
- [Operational Excellence - DevOps Patterns](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence-devops-patterns.html)
- [Export Backup Data from Salesforce](https://help.salesforce.com/s/articleView?id=sf.admin_exportdata.htm&type=5)
- [Backup & Recover for Salesforce](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o.htm&language=en_US)
- [View, Restore, and Manage Items in the Recycle Bin](https://help.salesforce.com/s/articleView?id=sf.home_delete.htm&type=5)
- [Salesforce Sandbox Types and Management Best Practices](https://help.salesforce.com/s/articleView?id=000387743&language=en_US&type=1)
- [SandboxPostCopy Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_System_SandboxPostCopy.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Platform Development Lifecycle and Deployment Architect pack (USD $19): https://www.certifyforce.com/practice-exams