How to verify your backups actually work

Almost every organization we work with has backups. Very few have ever tried restoring one. That distinction tends to surface at the worst possible moment.

An untested backup is an assumption. Here is the minimum routine to turn it into certainty.

1. Write down what you expect to recover, and how fast

Before reviewing tools, define two numbers:

• RPO (recovery point objective): how much data you can afford to lose. An hour of work? A day?
• RTO (recovery time objective): how long the operation can be down.

Without these numbers you cannot judge whether your current setup is sufficient or excessive.

2. Inventory what is actually being backed up

List everything the operation needs to run and check it against what is truly backed up. The most common gaps: firewall and switch configurations, cloud mailboxes, business system databases, and files people keep on their desktop.

3. Apply the 3-2-1 rule

Three copies of the data, on two different media, with one off-site. If your only external copy lives on a disk permanently attached to the same server, ransomware will encrypt it alongside the original.

4. Restore something real

Once a quarter, pick a concrete scenario and run it: recover a full database on a spare server, or rebuild a server from scratch. Time the process and compare it against your RTO. The first measurement is almost always far worse than expected, and that is exactly the value of the exercise.

5. Document the procedure and who runs it

You will not improvise well on incident day. Write down the restore order, the credentials needed (in a secure vault) and who owns each step. Include a backup contact: emergencies do not check the vacation calendar.

---

If you want us to review your current setup and measure real recovery time, get in touch. The initial assessment is free.