Your backup isn’t real until you’ve restored from it
Having backups and being able to recover are two different things. Here’s the 30-minute test that tells you which one you have.
Most backups fail the same way: quietly, for months, and nobody finds out until the day they’re needed.
If you run a Las Vegas small business, backup is probably on your list of things that are “handled.” Ask an owner if they have backups and the answer is almost always yes. Ask when they last restored from one and the room gets quiet.
That pause is the whole problem.
The backup that wasn’t
A backup job can report success every night while copying the wrong folder, skipping files that were open, or writing to a drive that filled up last spring. The software says green. The data says otherwise. You only learn which one is telling the truth when you try to get something back.
Nobody is being careless here. Backups are set up once, they run in the background, and nothing reminds you they exist until the worst day of your year. That’s exactly why they drift.
“We have backups” vs. “we can recover”
Recovery comes down to three questions, and a backup report answers none of them:
- Can you get the data back? Complete, current, and actually readable, not a corrupted file with the right name.
- How long does it take? A backup that takes four days to restore is a four-day closure. For a restaurant or a medical office, that’s the number that matters.
- Who knows how to do it? If the one person who set it up is on vacation or long gone, that’s your answer.
The restore test, step by step
Block 30 minutes. That’s it.
- Pick one important file and one important system. Think accounting data, the shared drive, or whatever runs your front counter.
- Restore the file to a different location. Open it. Check that it’s the latest version, not one from March.
- Restore the system, or a copy of it, and time how long until someone could actually work on it.
- Write down what broke, what was slow, and who did the work.
- Put the next test on the calendar for 90 days out.
If everything works, great. You now know something most of your competitors don’t. If something breaks, even better: you found it on your own terms, not during a ransomware attack.
The 3-2-1 rule, translated
Three copies of your data, on two different kinds of storage, with one copy somewhere else.
In plain English: the original, a local backup for fast restores, and an offsite or cloud copy for the day the building itself is the problem. Ransomware goes looking for backups it can reach, so at least one copy should be one it can’t touch: offline, or locked so it can’t be changed or deleted.
What good looks like
You restored what you needed. It was current. You know how long it took, and more than one person knows how to do it.
That’s not a technology win. That’s the difference between a bad morning and a bad month.
What to do Monday
- Ask whoever handles your IT one question: when did we last restore from backup, and how long did it take?
- Pick one file your business can’t live without and restore it yourself, or watch someone do it.
- Put a recurring restore test on the calendar every 90 days, with a name next to it.
Questions people ask
How often should a small business test its backups?
At least once a quarter, and any time you change systems. A quick single-file restore every month is even better, because it takes five minutes and catches most problems early.
Isn’t syncing to the cloud the same as a backup?
No. Sync tools copy changes everywhere, including deletions and files that ransomware has scrambled. A backup keeps older versions you can roll back to. You want both, and you want to know which is which.
Does Microsoft 365 back up my email and files?
Microsoft keeps the service running, but deleted items only stick around for a limited time, and under its shared responsibility model, protecting your data is your job. A separate backup closes that gap.