Your backups are only real if you have tested a restore

Almost every business we talk to says, "We have backups." Far fewer can tell us the last time they restored something from one. A backup you have never restored is a hope, not a plan.

How backups quietly fail

Backups rarely fail with a loud alarm. They fail quietly, months before anyone needs them. Here is what we see most often:

• The job stopped running. A password changed or a disk filled up, and nobody read the error email.
• The wrong things were backed up. The file server is covered, but the accounting database or a key laptop is not.
• The backup was connected to everything else. Ransomware locked the files, then locked the backup copy sitting right next to them.
• Nobody knows how to restore. The person who set it up left, and the login left with them.
• The restore takes far longer than expected. Pulling a full server back from the cloud can take days, not hours.

Microsoft 365 is not a backup on its own

Microsoft keeps the service running. Protecting your data from a mistaken delete, a bad sync, or a ransomware attack is still your job.

Deleted email and files sit in recycle bins for a limited time, and then they are gone. If a former employee's mailbox was removed last year, or someone wiped a SharePoint folder months ago, you may not get it back.

A separate Microsoft 365 backup keeps its own copy of Outlook email, OneDrive, SharePoint and Teams, outside your everyday account.

The 3-2-1 rule in plain English

• 3 copies of anything important: the live data plus two backups.
• 2 different kinds of storage, so one failure does not take out both.
• 1 copy offsite and locked, so it cannot be changed or deleted, even by someone with an admin password.

That last point matters most today. Attackers go after backups first, because a business that can restore has no reason to pay them.

How to run a restore test

You do not need a lab. You need a calendar reminder and an hour.

1. Pick one file someone uses every day. Restore it to a different folder and open it.
2. Pick one mailbox or shared folder. Restore a message or a folder from last month.
3. Once a quarter, restore a whole machine or server to a test spot. Make sure it starts and the key app opens.
4. Time every test. Write down how long it took. That is your real recovery time, not the number in the brochure.
5. Write down what broke and fix it before the next test.

Five questions to ask your IT provider

1. When did we last restore something, and did it work?
2. Which systems are backed up, and which are not?
3. Is at least one copy offline or locked so ransomware cannot touch it?
4. How long would it take to get our most important system running again?
5. Who gets the alert when a backup fails, and what do they do about it?

If the answers are vague, that is your answer.

What to do next

Run one restore test this month. It will tell you more than any report.

If you want help, our free Microsoft 365 security check shows how your email and files are protected today, including whether your Microsoft 365 data has its own backup. You keep the report. Our Complete plan includes backup and disaster recovery with regular restore tests, so you never have to wonder.