A backup you have never restored is a guess.

Almost every business has a backup. Far fewer have ever restored from one. The gap between the two is where the unpleasant surprises are, because a backup is only worth something on the day it has to be turned back into working files.

How a healthy-looking backup fails

The nightly report says the job finished. That tells you it ran. It does not tell you that the right things were in it, or that they can be read back. The usual causes are dull:

• The backup covers the folders that existed when it was set up, and not the ones created since.
• The software copies the files but not the database behind the accounting or booking system, or copies it while it is in use.
• The drive or cloud account filled up months ago, and new copies stopped being made.
• The backups are encrypted, and the only person who knew the password has left.
• Everything restores, but it takes four days and the business can survive one.

A cloud service is not a backup on its own

Microsoft 365 and Google Workspace keep their platforms running. Looking after what you put in them is still your job. Microsoft calls this shared responsibility: the provider is responsible for the service, and the customer is always responsible for their own data and accounts. A file deleted by mistake, or by someone on their way out, can only be recovered for a limited time unless you keep your own copy.

Two numbers worth agreeing on

Before testing anything, decide what a good result looks like. Two questions settle it.

• How much work can we afford to lose? If the answer is a day, a nightly backup is enough. If it is an hour, it is not. This is the recovery point objective.
• How long can we afford to be down? This is the recovery time objective. It decides whether restoring from the cloud over the office internet connection is fast enough.

How to run a restore test

1. Pick something real: a folder someone used this week, a mailbox, or the accounting database.
2. Restore it to a different location, never over the top of the live copy.
3. Open it. Check that the files are complete and current, and that the database starts.
4. Time it, and compare the result with how long you said you could be down.
5. Write down what was restored, what went wrong and who did it.
6. Fix what you found, then put the next test in the calendar.

A single file each month takes minutes. Restoring a whole server or a whole Microsoft 365 account is a bigger job, and worth doing at least once a year and after any major change.

Keep one copy out of reach

Ransomware goes looking for backups. It can encrypt a drive that is plugged in, or a network share that the infected computer can reach. The Australian Signals Directorate advises disconnecting backup media when a backup is not running, and keeping an offline copy. For cloud backups, the equivalent is a copy that cannot be changed or deleted for a set period, even by an administrator.

Regular backups are one of the Essential Eight, the Australian Government’s baseline for cyber security, for the same reason: when everything else has failed, the backup is what gets the business working again. See The Essential Eight: where a small business should start.

The method in brief is in our lesson on the 3-2-1 backup rule. If you would like the testing done for you, restore tests on a schedule are part of Data Management.