Most businesses have backups. Far fewer have backups that actually restore. Here's how to tell the difference — before ransomware does it for you.
Almost every business we meet has a backup. Almost none of them have a backup they've actually proven works. That gap is where most recovery disasters are born.
A backup is not a recovery plan. It's a copy of data. Recovery — the ability to run your business again after something breaks — is a different thing entirely, and it's the one that matters.
The test that tells you the truth
The only reliable way to know a backup works is to restore from it. Not to a staging server someone set up once. To a clean environment, on a deadline, by the person who would actually do it in a crisis.
If that sounds uncomfortable, good. That discomfort is the point. A restore test you've never run is a hope. A restore test you run quarterly is a plan.
The 3-2-1 rule, and where it quietly breaks
The 3-2-1 rule still holds: three copies of your data, on two different media, with one offsite. It's sound — and it's also where most small businesses fall short in the same way:
- The "offsite" copy is on a drive someone takes home. That's offsite, but it's not protected from ransomware that already encrypted the primary.
- The two media types are really one (two cloud buckets in the same tenant).
- The third copy was never set up; it was assumed.
The fix isn't more complexity. It's honesty about what you actually have.
Ransomware changes the math
Old-school backups assumed hardware failure. Ransomware assumes your backups are online and reachable — because if they are, it will encrypt them too.
That's why immutable, offline, or air-gapped backups matter more than they used to. If a ransomware operator with admin credentials can reach your backups, they aren't really backups. They're a second target.
Who owns it?
The most common reason backups fail isn't technology. It's ownership. The backup runs on a server nobody is responsible for. The offsite sync stopped failing loudly six months ago and started failing silently. Nobody noticed, because nobody was checking.
Recovery needs an owner, a schedule, and a definition of "done" that includes a successful restore — not just a successful backup job.
What to actually do
If you do one thing this quarter, run a real restore test. If you do two, add an immutable or offline copy for your most critical systems. If you do three, name an owner and put the test on a recurring calendar.
Want to know whether your backups would actually hold up? Start with an IT Health Check — we'll test, not assume.