How do I know if my business backups actually work?
Updated October 30, 2026
You know your backups work only when someone has restored real files from them recently and can show you the result. Good backups also run on their own, cover everything you can’t afford to lose, and keep a copy a hacked account can’t delete. You can check all of this in about half an hour, even if someone else runs them: ask for one folder to be restored, open the files, and write down what happened.
Steps
- Pick one real folder that matters, such as last month’s invoices or a current project, so the test proves something.
- Ask for it to be restored to a different location, so nothing current gets overwritten if something goes wrong.
- Open several of the files. A file that restores but won’t open isn’t a backup.
- Restore one file from a few weeks ago to see how far back you can really go.
- Time it, from asking to having the files open, because that’s roughly how long you’d wait on a bad day.
- Write it down: the date, what was restored, who did it, how long it took, and whether it worked.
Details
What good backups look like
Good backups pass six tests, and you don’t need to understand the technology to check them:
- They cover everything that matters: email, shared files, accounting, customer records, and the data behind your business software, not just one computer or folder.
- They run on their own. Nobody has to remember to plug in a drive or click a button.
- At least one copy lives somewhere separate, outside your building and behind different logins from your everyday accounts. CISA, the U.S. government’s cybersecurity agency, recommends keeping backups offline and encrypted, because ransomware often looks for backups to delete or encrypt (CISA #StopRansomware Guide).
- They go back far enough. If a file was damaged three weeks ago, a backup that keeps one week won’t help.
- Someone is told when they fail, and that person still works here.
- They’ve been tested, with a recent restore and a written date.
Missing one isn’t a disaster. It’s a list of things to fix.
Questions to ask whoever runs your backups
Ask the same questions whoever runs them, whether that’s you, an employee, a relative who’s good with computers, or an outside IT company, and ask for answers you can see:
- When was the last restore test, and what was restored? Ask this first. If there’s a recent, dated test, most of the other answers are already proven.
- What exactly is backed up? Which computers, mailboxes, shared drives, and business software.
- Where do the copies live? Is any copy separate from your Microsoft 365 or Google account and your office network?
- Who can delete the backups? If it’s the same admin account used for everything, one stolen password could wipe out your safety net.
- How far back can we go? Days, weeks, or months.
- Who gets told when a backup fails?
If you use an outside provider, CISA suggests making sure they follow good backup practices and putting your requirements in the contract (CISA #StopRansomware Guide). A good provider won’t mind the questions.
Why the written record matters
The written record from step 6 does two jobs: it tells you whether the backup works, and it’s the evidence a cyber insurance application or a client may ask for. Repeat the check every three months, and once a year restore something bigger, like a whole mailbox or laptop.
What a managed backup should include
A managed backup should meet the same standard as one you run yourself, with the answers in writing: what’s covered, where the copies live, how long they’re kept, who is alerted when something fails, and the date and result of the last restore test. How should a small business back up its files? covers how to build one.
New IT PLZ HELP clients get a backup of their Microsoft 365 email, OneDrive, SharePoint, and Teams, kept outside Microsoft 365 so a problem in your account doesn’t take the backup with it (we use Barracuda Cloud-to-Cloud Backup). Ask us anytime what’s covered.
Where doing it yourself gets risky
- Sync mistaken for backup. OneDrive, Google Drive, and Dropbox keep files in step across devices, so a deletion or a ransomware-locked file syncs too. See Does OneDrive back up my files?
- Cloud accounts nobody backs up. Microsoft and Google keep the service running, which isn’t the same as keeping your own copy.
- The real data lives somewhere else, such as a business application’s database instead of the Documents folder.
- Failure alerts going to a former employee’s inbox.
Signs it’s time for help
Get help if either of these is true. You can run the rest of this check yourself.
- The restore test doesn’t go smoothly, or the files won’t open.
- Nobody’s sure who runs your backups, or who to ask.
This week, pick one folder you’d hate to lose, have it restored to a new location, open the files, and write down the date and result. If it goes smoothly, put a reminder on the calendar for three months from now. If it doesn’t, tell us what’s going on, and we’ll tell you honestly whether we can help.
Book a free 20-minute fit check