Cybersecurity Education
How to Test Your Backups Before You Actually Need Them
Ask any business owner whether they have backups and the answer is yes. Ask when someone last restored a file from those backups, and the room goes quiet.
That quiet marks the difference between a backup system and a backup habit. The two look identical until the worst day of your business. The system is software. The habit is proof. When we assess businesses across Arizona, backups exist nearly every time. Evidence of a successful restore exists almost never.
Why a Green Dashboard Proves Less Than You Think
Backup software reports that its jobs ran. It cannot report that what it captured is complete, current, or usable. We have seen that gap take many forms:
- The job runs nightly, and has been backing up an empty folder since the file server was reorganized two years ago.
- The backup includes the accounting database, but in a state the accounting software cannot reopen.
- The backup covers files, and nobody realizes the recovery would take nine days because nobody ever measured it.
A 20-employee retail business came to us for an assessment. They had an I.T. person hired specifically to maintain their systems, and their executives told us in interviews that a full recovery would take about a day. Their I.T. person had told them so directly. Our assessment found the backups had not run in months. The confidence at the top and the reality in the server room had drifted that far apart, and nothing in daily operations would ever have revealed it. A restore test would have.
None of these failures shows up on a dashboard. Every one of them shows up in a ten-minute restore test. That is the entire argument for backup testing.
Pick a real file somebody edited recently. Restore yesterday's version to a different location, open it, and confirm it is intact. Write down the date, who did it, and how long it took. Put a recurring reminder on the calendar and repeat it monthly. Once a year, go bigger: restore a whole folder, a database, or a full server, and time it.
What Ransomware Changed About Backups
Modern ransomware crews destroy your backups before they encrypt your files. Backups are what let you refuse to pay, so attackers hunt them first. That changes what a good backup setup looks like:
- Keep one copy attackers cannot reach from your network. Use offline storage or immutable cloud storage that even an administrator account cannot delete. If your own admin credentials can wipe your backup, so can an attacker holding those credentials.
- Follow the 3-2-1 rule. Keep three copies of your data, on two different types of storage, with one off-site. A local copy plus a protected cloud copy covers most small businesses well.
- Back up your cloud data too. Microsoft 365 and Google Workspace replicate data to survive their hardware failures, not your mistakes. A deleted mailbox, a synced ransomware infection, or a malicious insider passes straight through their replication. Cloud-to-cloud backup is a separate layer, and most businesses are missing it.
- Treat recovery time as a business number. Knowing you can eventually restore everything differs from knowing payroll runs on Friday. Decide how much downtime you can afford, then test whether your restore fits that window. Your leadership should know both numbers.
Five Questions That Expose Weak Backups
Whoever manages your systems should answer these without flinching. The questions work on employees, contractors, and providers alike:
- When did a human last restore something, and where is that written down?
- If ransomware ran tonight with administrator access, which backup copy would survive, and why?
- How long would a full restore of our most important system take? Is that measured or guessed?
- Who besides one person can operate the restore?
- What exactly is excluded from backup, and who approved that list?
Vague answers to these questions predict a bad recovery. You want dates, documents, and measured numbers. The retail business above would have failed question one, and asking it would have cost their executives thirty seconds.
Where Backup Testing Fits in the Bigger Picture
Backups are the least glamorous control in security and the one with the most leverage. Tested restores turn ransomware from a business-ending event into a bad week. Your cyber insurance questionnaire asks about restore testing for the same reason our assessment examines it as one of nine core areas. For managed clients, restore tests run on a schedule with documented recovery times, as a standing rhythm rather than a one-time project.
The first step needs none of that. You need ten minutes, one file, and a calendar reminder. If the test works, you have evidence. If it fails, you found out on a calm Tuesday, which is the cheapest this discovery will ever be.
