Almost every business we assess believes it has a backup. Most of them are right. What they usually do not have is a tested restore, and those are not the same thing. A backup is a promise. A restore is the proof.
The gap between the two is where companies lose weeks. The backup job ran green every night for two years, and then the day it was needed the restore failed, or it worked but took four days, or it brought back the files and not the database that made the files mean anything.
Why Green Does Not Mean Safe
Backup software reports on whether it finished copying data. That is a narrow question. It does not tell you whether the copy is usable, whether it contains everything the business needs to function, or how long it would take to turn that copy back into a working company.
We see the same four failures over and over.
Something important was never included. A server was added, a line of business application moved to a new host, a database started living somewhere else. Nobody updated the backup selection, and nobody noticed because the job kept reporting success on everything it was still told to copy.
The only copy is reachable from the network it protects. Modern ransomware looks for backups first. If the backup target is a share that a compromised administrator account can write to, it is not a backup, it is another set of files waiting to be encrypted. Immutable or genuinely offline copies are the difference.
Nobody has measured how long a restore takes. There is a large difference between recovering a deleted file and recovering an entire server, and a larger one still between recovering one server and recovering all of them at once over an internet connection sized for email. Companies routinely discover their real recovery time is measured in days when they had assumed hours.
The cloud is assumed to be covered. Microsoft 365 and Google Workspace keep your data available. They do not keep a long-term backup of it against a mistake you make. Deleted mailboxes, purged SharePoint sites and a departed employee’s files all have retention limits, and those limits are shorter than most people assume.
Four Questions That Expose The Truth In Ten Minutes
You do not need to be technical to run this test. Ask whoever manages your IT the following, and pay attention to how quickly and how specifically they answer.
1. When did we last restore something, and what was it? The right answer names a date, a system and a person. A vague answer, or one about the backup running successfully, is the answer.
2. If the building burned down tonight, how long until we can take orders again? You are looking for a number in hours, and an explanation of what happens in those hours. If the answer is a shrug or a description of software, keep going.
3. Which systems are not in the backup? There is always something, and a good answer tells you what and why. An answer of “everything is backed up” is almost never true and usually means nobody has checked the list this year.
4. Could an attacker who owns our network also delete the backups? If the honest answer is yes, the backup will not survive the one event it exists for.
What Good Actually Looks Like
A backup you can rely on has four properties. More than one copy, with at least one that cannot be altered or deleted from your production network. A written recovery time for each critical system, agreed by the business rather than assumed by IT. A restore actually performed on a schedule, into an isolated environment, with the result recorded. And a documented order of recovery, so that in a real incident nobody is deciding on the day which server comes back first.
None of that is exotic and none of it is expensive relative to the alternative. It simply has to be somebody’s job, on a calendar, with evidence.
Where To Start This Week
Pick the one system that would hurt most if it disappeared. Ask for a restore of it into a test environment, and time it. Do not warn anyone a week in advance, because a rehearsed restore proves less than a cold one.
Whatever the result, you will know something you did not know on Monday. If it works, you have evidence. If it does not, you found out on a day of your choosing rather than on the worst day of the year.
Our backup and disaster recovery service is built around exactly this: immutable copies, documented recovery times and quarterly restore tests with the results written down. Prefer to see everything before deciding? A free cyber assessment checks backup as one part of a wider review, and the report it produces is yours to keep with no obligation to hire us.
For the underlying standards, the Cybersecurity and Infrastructure Security Agency publishes plain guidance on backup options that is worth ten minutes of any business owner’s time.