Backup testing for small businesses: can you restore the files you need?
To check a backup properly, agree a representative item and the point in time you need, restore it somewhere safe, open it and check the contents. Record how long the process took and anything that needs fixing. Arrange this with the person responsible for your backups before starting.
A successful sample restore gives you evidence about that item and recovery route. It does not prove that every file, application or part of the business could recover after a major incident.
What does a successful backup notification tell you?
A success message tells you what the backup product reports about a job. Check which data that job covered, when it ran and whether anything was excluded or skipped.
The next question is whether somebody can recover the information the business actually needs. A file might be present but from the wrong date. A folder added last month might not be included. The only person who understands the recovery process might be unavailable.
The NCSC's small-organisation backup guidance recommends knowing how to restore your backup and checking that it includes your important data.
Confirm what is covered first
List the main places your business information lives: email, shared documents, accounting software, other business applications and files stored on laptops. They may have different backup arrangements and recovery options. For Microsoft 365 files, our OneDrive vs SharePoint guide explains where different types of business work belong.
Ask who looks after each one, how far back retained copies go and what is excluded. “We back up Microsoft 365” still needs a clear answer about which accounts, mailboxes and sites are included.
Choose one representative item for the first test. Avoid selecting the easiest file simply because you know it will work. Equally, do not start by restoring a live accounting database over the current one.
Backup testing: a five-part restore check
1. Name the item and the version you need
Write down the document, message or other item, its normal location and the date or version you want to recover. Ask its business owner what would demonstrate that it is the right copy.
Before testing, agree how old a recovered copy could be and how long recovery could take while remaining useful.
2. Confirm who can start recovery
Identify the authorised person who can perform the restore and who provides cover. Check whether the instructions and support contact details remain available if the usual laptop or email account is unavailable.
Discuss emergency access arrangements with your provider without putting passwords or recovery secrets in an ordinary test record. The NCSC's cloud-backup principles specifically address retaining access when normal corporate systems are unavailable.
3. Restore away from live data
Use the backup product's supported alternative-location or isolated-test method. Agree the destination and access permissions before running it. Keep the restored copy clearly labelled so nobody mistakes it for current work.
Do not delete a live file to create a test, overwrite current records or roll back a working system. If the available recovery option would affect live data, stop and ask your provider to arrange a safe test. NCSC guidance supports testing without damaging existing infrastructure.
4. Open the result and check the contents
Have the person who understands the work confirm the recovered item is usable. Check the expected version, important content, attachments where relevant and who can access the restored copy.
A filename appearing in a folder is only the start. For business applications or databases, ask the application specialist what a proper recovery test involves; copying a data file alone may leave required components untested.
5. Record time, gaps and the next action
Measure from starting the recovery request to having a usable, checked result. Include time waiting for access or assistance, rather than recording only the file-transfer time.
Keep a short record of the test date, backup service or recovery route, item and restore point, who performed and checked the test, destination, elapsed time and result. Compare the result against the agreed limits. Give each problem an owner and a retest date.
What would a useful test look like?
Imagine choosing a completed job document from an agreed date. Your provider restores a copy into a restricted test location while the live folder remains untouched.
The colleague responsible checks the job reference, final revision and a known detail in the completed work. They confirm the intended people can open it. If the recovered document is an earlier draft, record that gap even though the restore job itself succeeded.
After checking, agree how the temporary copy will be removed or retained securely.
Check two different recovery needs
Ask how much recent work the business could afford to lose, and how long it could operate without the information or system.
A recent backup may still take too long to restore. A quick restore may bring back a copy that is too old to use.
Agree realistic targets for important systems with the people who use and support them. Restoring one document cannot establish how long it would take to rebuild laptops, recover applications and get everyone working again.
How often should you test?
Set a schedule based on the importance of the data, how quickly things change and the backup arrangement. Recheck after significant changes to systems, providers, permissions or where information is stored.
The NCSC recommends regular restore testing. Agree which data and systems will be sampled over time, and when a wider recovery exercise is needed. Keep failed checks open until the issue has been corrected and retested.
If you suspect an active cyber incident, follow your incident-response arrangements with your provider rather than treating it as a routine test.
Does Microsoft 365 already provide recovery?
Microsoft 365 has recovery features, including file version history and SharePoint deleted-item recovery, with limits that depend on the service and setup. Microsoft also offers Microsoft 365 Backup, and third-party backup services are available.
Ask which capabilities are actually configured for your business, what they cover and how they will be tested. Do not assume that every available recovery feature or backup service is enabled.
Unsure what your backups could restore?
Cache4 manages agreed backup services as part of its cyber security support for small businesses in Carlisle, across Cumbria and beyond.
Book a free 30-minute Discovery Call with Paul Crooks. Bring what you know about your backup arrangements and the information your business would need first. We can discuss the next sensible check without you sending private files. No pressure or obligation.
Comments