Is Your Backup Actually Restorable? How to Test It and Prove It

Most business owners we meet can tell us that they have a backup. Far fewer can tell us when they last restored something from it, how long it took, and whether every file came back. That gap is where small businesses get hurt. A backup that has never been tested is a hope, not a plan.

This article explains why backups fail, how the 3-2-1 rule works, how to run and record a simple test restore, what to ask your IT provider, and why the data in Microsoft 365 needs its own protection.

Why backups fail when you need them

Backups rarely fail in a dramatic way. They fail quietly, months before anyone notices. The most common causes we see are:

• The job stopped running. A password changed, a drive filled up or a computer was replaced, and the backup has been failing for weeks with nobody reading the alerts.
• The wrong things are backed up. The server is covered, but the accounting file lives on one person's desktop, or a new shared folder was never added to the backup.
• The backup was reachable by the attacker. Ransomware does not only encrypt your files. It often looks for connected backup drives and network shares and encrypts or deletes those too.
• Nobody knows how to restore. The person who set it up has left, the recovery password is missing, or the restore takes days instead of hours.
• The copy is too old. The backup works, but it only keeps a week of history, and the problem started three weeks ago.

Every one of these is found by a test restore. None of them is found by a green tick on a dashboard.

The 3-2-1 rule in plain English

The Canadian Centre for Cyber Security describes the 3-2-1 rule this way: keep three copies of your information (the original plus two backups), store the backups on two different types of media, and keep one copy off site. It also recommends keeping at least one backup disconnected from your network, because an offline copy cannot be reached by ransomware spreading across connected devices.

For a typical small office, this might mean your working files in Microsoft 365 or on a server, a backup to a local device in the office, and a second backup to a separate cloud service that keeps copies which cannot be changed or deleted for a set period. The exact tools matter less than the principle: no single event, whether a fire, a stolen laptop, a ransomware attack or a mistaken deletion, should be able to destroy every copy.

How to run a test restore

The Canadian Centre for Cyber Security recommends routinely testing that you can recover from your backups, and defining who does what during recovery. A test restore does not have to be complicated. It needs to be real, regular and written down.

What to record each time

This log is also useful evidence. Cyber insurers often ask about backups and recovery when you apply or renew, and a record of real tests is a far stronger answer than "yes, we have backups." Our article on cyber insurance requirements in Canada covers what underwriters typically ask.

Microsoft 365 data needs its own backup

Many businesses assume that because their email and files live in Microsoft 365, Microsoft is backing them up. Microsoft does build a lot of resilience into its service, keeping copies of data in separate locations so that hardware failures in its data centres do not lose your mail. But that protects against Microsoft's problems, not yours.

Microsoft's own documentation on data resiliency says that most data loss results from customer actions, and its Services Agreement states: "We recommend that you regularly backup Your Content and Data." The built-in recovery tools are time limited. For example, Microsoft documents that deleted SharePoint sites are kept for 93 days, and that when a user's licence is removed or the account is deleted, the mailbox content is kept for 30 days before it is permanently deleted.

That leaves real gaps:

• An employee deletes a folder and nobody notices for four months.
• A departing staff member's account is removed and, six weeks later, someone needs an email from their mailbox.
• An attacker who takes over an account deletes or encrypts files in OneDrive and SharePoint.

A separate backup of Microsoft 365, kept outside your Microsoft 365 account, closes those gaps. It should include Exchange mailboxes, OneDrive, SharePoint and Teams files, and it should be tested the same way as everything else. Our Microsoft 365 page explains how we manage it for clients.

Questions to ask your IT provider

You do not need to understand the technology to hold your provider to account. These questions get to the point quickly:

1. What exactly is being backed up, and what is not? Can I see the list?
2. Where are the copies kept, and is at least one of them offline or protected so it cannot be changed or deleted by an attacker?
3. How far back can we restore? Days, weeks, months?
4. Is Microsoft 365 backed up separately, including mailboxes, OneDrive, SharePoint and Teams?
5. When was the last test restore, what was restored, and can I see the record?
6. If our main system was lost today, how long would it take to get running again?
7. Who is alerted when a backup fails, and how quickly is it fixed?
8. Are the backups encrypted, and who holds the recovery keys?

A good provider will welcome these questions and answer them in writing. If the answers are vague, treat that as a finding in itself.

Privacy and backups

Backups usually contain personal information about customers and staff, so they need the same protection as the original data. The BC Personal Information Protection Act (PIPA) requires organizations to protect personal information in their custody or under their control with reasonable security arrangements, and federal PIPEDA has a similar safeguarding principle. In practice, that means encrypting backups, limiting who can access them, and knowing where they are stored.

Start with one test this month

If you have never tested a restore, do not wait for the perfect plan. Pick one important folder, restore it to a safe place this week, and write down what happened. That single test will tell you more about your real recovery ability than any report. For a broader view of planning for outages and ransomware, see our backup and disaster recovery page and our article on the first 60 minutes of a ransomware attack.

Related articles: Ransomware Note on Your Screen: The First 60 Minutes · Lost Microsoft 365 Admin Access · Cyber Insurance Requirements in Canada

← Back to Blog