# Ensure Volumes Have Snapshot Or Backup Policies

- Source: https://support.icompaas.com/support/solutions/articles/ensure-volumes-have-snapshot-or-backup-policies
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## Description

This rule checks that every Block Storage Volume holding production data is covered by a recurring snapshot routine, giving it a recovery point that is independent of the attached Droplet's own backup state.

DigitalOcean volume snapshots are on-demand only — the platform does not offer a built-in scheduled-snapshot policy for Block Storage Volumes (unlike Droplet backups). A "snapshot policy" for a volume therefore means an operator-run schedule: an automation (cron, DigitalOcean Functions, a CI job, or a third-party backup service) that calls the snapshot API on a defined cadence and prunes old snapshots.

The rule looks for evidence of recent, regularly-spaced snapshots on each production volume. Remediation is to define a cadence matched to the data's change rate and recovery objectives, automate it, verify completion, and periodically test restoring a volume from a snapshot.

-   Production volumes with no snapshots at all.
    
-   Volumes whose most recent snapshot is older than the intended cadence (a stale one-off snapshot rather than an ongoing routine).
    

## Rationale

A volume snapshot is often the only recovery path for the data on a Block Storage Volume: if the volume is corrupted, accidentally deleted, or lost to an infrastructure fault, there is nothing to restore from unless a snapshot exists. Relying on the attached Droplet's backup is not equivalent — Droplet backups and volume snapshots are separate features.

A regular cadence bounds the maximum data loss (recovery point objective). A single historical snapshot only protects data as of one moment and silently ages into uselessness.

## Impact

Pros:

-   Provides an independent, restorable recovery point for volume data.
    
-   Bounds worst-case data loss to the snapshot interval.
    
-   Enables fast recovery by creating a new volume directly from a snapshot.
    

Cons:

-   Stored snapshots incur storage charges that grow with retention.
    
-   DigitalOcean has no native scheduler for volume snapshots, so the cadence must be built and maintained by the operator.
    
-   Limits apply: at most one snapshot per volume every 10 minutes and up to 25 stored snapshots per volume, so retention must be pruned.
    

## Default Value

DigitalOcean volume snapshots are on-demand only; there is no built-in scheduled snapshot policy for Block Storage Volumes, so new volumes have no recurring snapshots unless you automate them.

## Pre-Requisite

-   Account role that can create and list volume snapshots.
    
-   doctl authenticated or an API token, plus a scheduler (cron, DigitalOcean Functions, or a third-party backup tool) to run snapshots on a cadence.
    
-   Defined RPO and retention requirements per volume.
    

## Remediation

### Test Plan

Using the DigitalOcean Control Panel:

1.  Sign in at cloud.digitalocean.com and open Manage > Volumes.
    
2.  Click a production volume to open it, then open its Snapshots tab.
    
3.  Review the snapshots and their creation dates; confirm snapshots exist and are spaced at the intended cadence (not a single old snapshot).
    
4.  Repeat for each production volume.
    
5.  Pass: each production volume has recent snapshots spaced at the intended cadence.
    
6.  Fail: a production volume has no snapshots, or only a stale/one-off snapshot older than the intended interval.
    

Using doctl or the API:

List each volume's snapshots and check the most recent created\_at against your intended cadence.

curl -s -X GET -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/volumes/<volume-id>/snapshots"

doctl compute snapshot list --resource volume

Pass: the volume returns snapshots whose newest created\_at is within your intended interval. Fail: no snapshots are returned, or the newest is older than the intended cadence.

### Implementation Steps

Using the DigitalOcean Control Panel:

1.  Decide a snapshot cadence per volume from its change rate and RPO.
    
2.  As an immediate baseline, open Manage > Volumes, click the volume's More menu, and choose Take Snapshot.
    
3.  Because the Control Panel cannot schedule snapshots, set up automation (below) to repeat on the cadence and prune snapshots beyond retention (max 25 per volume).
    
4.  Periodically create a test volume from a snapshot to confirm restorability.
    

Using doctl or the API:

Create snapshots on demand and drive them on a schedule from your own automation (cron, DigitalOcean Functions, CI, or a third-party backup service) — DigitalOcean has no native volume-snapshot scheduler.

doctl compute volume snapshot <volume-id> --snapshot-name <name>

curl -s -X POST -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" -H "Content-Type: application/json" -d '{"name":"<snapshot-name>"}' "https://api.digitalocean.com/v2/volumes/<volume-id>/snapshots"

### Backout Plan:

1.  To stop the routine, disable the scheduled automation you created.
    
2.  Delete unwanted snapshots via Manage > Snapshots > Volumes, or doctl compute snapshot delete <snapshot-id>.
    
3.  Note: deleting snapshots removes those recovery points.
    

## References:

1.  [How to Create Snapshots of Volumes](https://docs.digitalocean.com/products/snapshots/how-to/snapshot-volumes/)
    
2.  [Snapshots overview](https://docs.digitalocean.com/products/snapshots/)
    
3.  [Snapshots limits (25 per volume, one per 10 minutes)](https://docs.digitalocean.com/products/snapshots/details/limits/)
    
4.  [Volumes API and CLI reference](https://docs.digitalocean.com/products/volumes/reference/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.