How to tell whether your business backups actually work

Ask whether your backups are complete, current and restorable. A recovery test gives you a clearer picture before the day you need to use them.

Why backups fail without anyone noticing

• A backup job stopped running months ago and nobody checked the alerts.
• New folders, computers or cloud services were added but never included.
• The only copy sits in the same office as the original, exposed to the same fire, flood or theft.
• Ransomware encrypted the backup along with everything else because it was always connected.

Start with the 3-2-1 rule

A simple, widely used standard: keep three copies of important data, on two different kinds of storage, with one copy offsite. For example, the original files, a local backup device and a cloud backup. For ransomware protection, make sure at least one copy can't be changed or deleted from your normal network.

Check what is actually covered

• Servers and shared drives. The obvious one, but confirm every shared folder is included.
• Individual computers. Files saved to desktops and local drives are often missed.
• Microsoft 365 or Google Workspace. Email, OneDrive and SharePoint need their own backup. Cloud storage and sync are not the same as a backup you control.
• Business applications. Accounting, practice-management and other line-of-business data may live in a database that needs special handling.
• Settings and documentation. Network configurations and passwords stored securely make rebuilding much faster.

Test restores on a schedule

The only real proof is a restore. Pick a few files regularly and restore them to a test location. At least once or twice a year, run a larger exercise, such as restoring a whole server or mailbox, and time how long it takes. Write down what went wrong and fix it.

Know your recovery targets

Two plain questions shape your backup plan:

• How long can we be down? If the answer is hours rather than days, you need faster recovery options, not just copies of files.
• How much work can we afford to redo? If losing a full day of work is unacceptable, backups need to run more often than once a night.

A quick checklist

• Backups run automatically and someone reviews the results.
• At least one copy is offsite and protected from being changed or deleted.
• Cloud services such as Microsoft 365 are backed up separately.
• A restore has been tested recently, and you know how long it took.
• There is a written recovery order and contact list stored outside the office.

Want a fast read on the basics? Try our free IT risk self-check.