How to tell whether your business backups actually work

Almost every business says it has backups. Far fewer know whether those backups are complete, current and restorable. Backups tend to fail quietly, and the failure is usually discovered on the day you need them.

Why backups fail without anyone noticing

• A backup job stopped running months ago and nobody checked the alerts.
• New folders, computers or cloud services were added but never included.
• The only copy sits in the same office as the original, exposed to the same fire, flood or theft.
• Ransomware encrypted the backup along with everything else because it was always connected.

Start with the 3-2-1 rule

A simple, widely used standard: keep three copies of important data, on two different kinds of storage, with one copy offsite. For example, the original files, a local backup device and a cloud backup. For ransomware protection, make sure at least one copy can't be changed or deleted from your normal network.

Check what is actually covered

• Servers and shared drives. The obvious one, but confirm every shared folder is included.
• Individual computers. Files saved to desktops and local drives are often missed.
• Microsoft 365 or Google Workspace. Email, OneDrive and SharePoint need their own backup. Cloud storage and sync are not the same as a backup you control.
• Business applications. Accounting, practice-management and other line-of-business data may live in a database that needs special handling.
• Settings and documentation. Network configurations and passwords stored securely make rebuilding much faster.

Test restores on a schedule

The only real proof is a restore. Pick a few files regularly and restore them to a test location. At least once or twice a year, run a larger exercise, such as restoring a whole server or mailbox, and time how long it takes. Write down what went wrong and fix it.

Know your recovery targets

Two plain questions shape your backup plan:

• How long can we be down? If the answer is hours rather than days, you need faster recovery options, not just copies of files.
• How much work can we afford to redo? If losing a full day of work is unacceptable, backups need to run more often than once a night.

A quick checklist

• Backups run automatically and someone reviews the results.
• At least one copy is offsite and protected from being changed or deleted.
• Cloud services such as Microsoft 365 are backed up separately.
• A restore has been tested recently, and you know how long it took.
• There is a written recovery order and contact list stored outside the office.

Want a fast read on the basics? Try our free IT risk self-check.