Most small businesses have some kind of backup. Far fewer know whether it works. Backups fail quietly: a full disk, an expired licence, a changed password or a folder that was moved, and the job keeps reporting success while it no longer copies what matters. You find out on the day you need it.

The only proof that a backup works is a successful restore. This article gives a routine to test that, without risking your live data.

First: what should be backed up?

Make a short list of what your business can’t do without. Typically:

  • Files: shared folders, documents, the contents of laptops that aren’t synced anywhere.
  • Cloud services: Microsoft 365 or Google Workspace mail and files. These providers keep your data available, but deleted items are only recoverable for a limited time, and a compromised account can delete a lot. A separate backup covers that.
  • Business applications: accounting, the web shop, a customer database. Check whether the supplier makes backups, and whether you can get an export yourself.
  • Configuration: website, domain and DNS settings, router and firewall configuration.

For each item, write down two things: how much work you can afford to lose (a day? an hour?), and how quickly it has to be back. Those two answers decide how often you back up and what kind of backup you need.

The 3-2-1 rule

A sound backup setup has three copies of your data, on two different kinds of storage, with one copy at a different location. A copy that can’t be changed or deleted from your network, such as an offline disk or immutable cloud storage, is what protects you against ransomware, which deliberately looks for backups to encrypt as well.

A sync service such as OneDrive or Dropbox is not a backup on its own: a deleted or encrypted file is synced everywhere within seconds.

The restore test, step by step

Plan this every quarter, and after every change to the backup setup.

  1. Pick something specific. One folder, one mailbox, or the database of one application. Vary it each time.
  2. Restore to a different location. Never overwrite the live data during a test. Use a separate folder, a test computer or a spare mailbox.
  3. Open what you restored. A file list is not enough. Open the documents, check that a spreadsheet calculates, that photos display and that the most recent change is there.
  4. Check the date. Is the newest restored version as recent as you expect? This catches backups that silently stopped weeks ago.
  5. Time it. How long did the restore take? Is that acceptable if it were your entire system?
  6. Write it down. Date, what you tested, the result and the time it took. One line in a shared document is enough.

Once a year, do a larger test: restore a complete laptop or server, or an entire application, as if the original were gone.

Warning signs

  • Backup reports that nobody reads, or that go to the mailbox of someone who has left.
  • A backup that has never sent an error. Every system fails occasionally; silence often means the reports don’t arrive.
  • One copy only, on a disk that is permanently connected to the computer it protects.
  • Nobody besides one person knows how to restore.

Next step

If the test fails or you’re unsure what your setup covers, that is exactly what the IT-scan looks at: what is backed up, where it goes, and whether it can be restored.