Are your backups really working? A five-minute self-check

Most business owners we speak to believe they have backups. Usually they are right, in the sense that something, somewhere, is copying data. The harder question is whether that copy would get the business working again, quickly, on the day it is needed.

You do not need to be technical to find out. The eight questions below can be answered in about five minutes, either by you or by whoever looks after your IT. If any answer is “I’m not sure”, that is your result.

The five-minute self-check

1. What exactly is being backed up?

Write down the systems your business cannot work without: the file server, the accounting database, the practice management system, email, and anything stored in OneDrive, SharePoint or Teams. Then check each one is in the backup.

Microsoft 365 deserves special attention. Many people assume Microsoft backs up their mail and files in a way they can restore from at will. Microsoft keeps the service running and offers recycle bins and retention features, but those are not the same as an independent backup you control, with restore points going back months. If a user deletes a folder and nobody notices for a while, or a compromised account wipes a mailbox, you want your own copy.

Laptops matter too. If staff save work to their desktop rather than to OneDrive or a server, that work may not be covered at all.

2. Is there a copy off-site?

A backup sitting on a disk next to the server it protects will not help if there is a fire, a burst pipe, theft or a power surge that takes out the whole rack. At least one copy should live somewhere else, ideally in the cloud or a separate data centre.

3. When did the last backup actually succeed?

Not “when is it scheduled”, but when did a job last complete without errors. Ask to see the date. Backup jobs can fail quietly for weeks when a password changes, a disk fills up or a server is renamed.

4. When did someone last test a restore?

This is the question that separates a backup from a hope. A test restore means picking a real file, mailbox or server and bringing it back, then checking it opens and is complete. If nobody can remember the last time this happened, schedule one this month.

5. How long would a full restore take, and how long can you be down?

These are two different numbers and they need to match.

• Ask: if the main server died this morning, how many hours would it take to restore everything and have staff working again?
• Then ask yourself: how many hours can the business run without it before it starts losing clients, missing deadlines or breaking commitments?

A 30-person accounting firm in Centurion during tax season might tolerate half a day. If a full restore from a cloud copy over the office fibre would take three days, that gap needs a plan, whether that is a local copy for fast restores, a standby server, or restoring to a hosted server in a South African data centre while the office hardware is sorted out.

6. How much data could you lose?

If backups run once a night and the server fails at four in the afternoon, you lose a day’s work. For some businesses that is fine. For others, such as a busy medical practice capturing patient records all day, it is not. Check how often each important system is backed up and whether that matches how often the data changes.

7. Who gets the failure alert?

Every backup system can send an alert when a job fails. Find out where those alerts go. If the answer is a former employee’s mailbox, a shared inbox nobody reads, or “I think it emails someone”, treat that as a failed check. Alerts only help if a named person acts on them.

8. Are backups protected from ransomware and from deletion?

Modern ransomware attacks often look for backups first, because deleting them makes the victim more likely to pay. Ask:

• Is the backup stored somewhere that ordinary network accounts cannot reach?
• Can backups be deleted by a single admin login, or is there a delay, a second approval or an immutable retention period?
• Is the backup console protected with MFA?

Our post on ransomware readiness goes into this in more depth.

The 3-2-1 idea, simply explained

A good rule of thumb that has stood the test of time is 3-2-1:

• 3 copies of your data: the live data plus two backups.
• 2 different types of storage: for example, a local backup appliance and cloud storage.
• 1 copy off-site: physically separate from the office.

Many organisations now add a further consideration: at least one copy should be isolated or protected so that it cannot be altered or deleted from your normal network, even by an administrator account that has been compromised.

You do not need to follow 3-2-1 to the letter. The point is that no single event (a failed disk, a fire, a ransomware attack or a mistaken deletion) should be able to destroy every copy at once.

What good looks like

If your backups are in good shape, you should be able to say something like this without hesitation:

“Our servers, laptops and Microsoft 365 are backed up every night to the cloud, with a local copy for fast restores. Failures alert our IT provider, who checks them daily. We test a restore every month and we know a full recovery would take about a day.”

In practice, for the businesses we look after, that means:

• Coverage of everything that matters: servers, workstations and Microsoft 365 mail, OneDrive and SharePoint, all protected with Cove Data Protection.
• Cloud-based, off-site storage separate from your office network.
• Daily monitoring of job results, with failures raised as tickets so they are tracked to resolution, not lost in an inbox.
• Regular test restores, recorded, so you can see when the last one happened and whether it worked.
• A known recovery time for your key systems, agreed in advance, rather than discovered during an outage.

We do not promise that nothing will ever go wrong. Backups are verified and restores tested regularly, which is the honest way to have confidence in them.

If you scored poorly

Do not worry if several answers were “not sure”. That is the most common outcome, and it is far better to find out now than during an incident. A sensible order of work:

1. Confirm who has access to the backup console and where alerts go.
2. Check the last successful job date for each critical system.
3. Add Microsoft 365 to the backup if it is not there.
4. Make sure there is an off-site copy.
5. Run and record a test restore.
6. Agree how long you can afford to be down, and check the restore time matches.

If your IT person has recently left and you cannot answer any of these, start with our IT handover checklist.

A second opinion, if it helps

Backups are also the quiet foundation for anything more ambitious. If you are thinking about automating workflows or adding AI tools, you want to know that a mistake can be rolled back. We cover that in why automation needs solid IT.

Our free Automation & Risk Check includes a look at your backups alongside security, documentation and where automation would pay off. It takes 30 minutes and you receive a one-page report. No obligation.