Cognitive data backup

A computer system for data backup based on a workload behavior, comprising:

• one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:
• identifying by a first computer, using machine learning tools, data associated with frequently accessed files on the first computer by a workload being processed by a second computer;
• processing, by the first computer, the identified data associated with the frequently accessed files to generate a list of frequently accessed files by the workload;
• creating, by the first computer, a timestamp for each of the frequently accessed files in the list of frequently accessed files, the timestamp comprising a time at which a file was last modified, a file creation time, a time the file was last accessed, a time file metadata was changed, or a time the file was last backed up, wherein the timestamp allows the list of frequently accessed files to be compared with backup policy rules active on the first computer;
• comparing, by the first computer, the list of frequently accessed files to the backup policy;
• based on the comparison, identifying, by the first computer, a mismatch between the list of frequently accessed files and the backup policy rules;
• and
• for each identified mismatch between the list of frequently accessed files and the backup policy rules, specifying, by the first computer, a new backup rule to update the backup policy rules.