A backup you've never restored is a hope, not a plan

What a successful backup report tells you

A successful report generally means the backup system completed its configured task. That matters. Failed jobs need attention.

But the report reflects what the system was told to protect. It cannot decide whether a new shared folder belongs in the backup or whether a recovered spreadsheet makes sense to your office manager.

Think of it like packing supplies for a job. Checking that the boxes reached the truck is useful. Opening them and confirming the right tools are inside answers a different question.

A restore test brings selected information back from a backup into a separate, safe location. Then someone checks that it opens, contains the expected information, and works for its intended purpose.

That turns an assumption into something observable.

The 3-2-1 rule in plain English

The 3-2-1 rule is a useful starting point for arranging backups:

• Three copies of your data: your working information plus two backup copies.
• Two different storage types: for example, a local backup device and a cloud backup service.
• One copy off-site: somewhere separate from your business premises.

The purpose is separation. A problem affecting one copy should not automatically affect every copy.

A backup drive beside your computer can help recover a deleted file. If both devices are damaged in the same event, that nearby copy may be unavailable too. An off-site copy addresses a different kind of problem.

Access matters as well as location. If the same compromised account can erase every backup, having several copies provides less protection than it appears to. Depending on the setup, a disconnected copy or a backup protected against changes can add another layer.

The 3-2-1 rule describes where copies live. Testing shows whether you can use them. Both deserve attention.

A synced folder needs a closer look

A cloud folder can make everyday work easier. Files appear on multiple computers, and changes travel between them.

That same convenience can carry mistakes. Deleting or overwriting a file may sync that change to other devices.

Some services provide version history and deleted-file recovery. Those features can help, but their limits matter: how far back recovery goes, what information is covered, and who has permission to restore it.

We treat those as details to verify. “It’s in the cloud” does not explain how a business would recover a particular file from a particular date.

What we check during a restore test

A useful test follows the work your business needs to resume. Our approach centers on these checks.

Are the right things included?

We compare the backup’s contents with the information the business relies on: shared documents, customer records, accounting data, and other essential files.

We also look for gaps created by change. A new computer, application, or folder can change what needs protection.

Is the recovery point recent enough?

The recovery point is the date and time the saved information represents.

If the latest usable copy is from last night, work completed this morning may need to be recreated. We compare that potential gap with what the business can reasonably tolerate.

The answer may differ between an archive of old projects and records updated throughout each working day.

Do recovered files work?

Seeing a filename is only the beginning. We check whether representative documents open and contain the expected information.

For application data, recovery may require the correct software, settings, or a supported restore process. Copying a database file into a folder does not, by itself, prove the application can use it.

Someone familiar with the business information helps confirm that the recovered result is meaningful.

Can authorized people complete recovery?

A backup can be intact while access becomes the obstacle.

We check the practical requirements: account access, recovery instructions, encryption keys where applicable, and who is responsible for each step. The plan also needs a path forward if the usual contact is unavailable.

How long does the process take?

We record elapsed time, including downloading data, preparing a replacement system, restoring files, and checking the result.

A small document restore cannot establish how long an entire business system will take. Test results need to state that limit clearly.

Keep the evidence, then repeat the test

A useful test record identifies what was restored, which backup it came from, how long recovery took, and what passed or failed. Any problems need an owner and a follow-up check.

Testing belongs on a regular schedule and after meaningful changes, such as replacing backup software or moving important data. The scope should reflect how much the business depends on each system.

CISA’s Secure Our World provides broader cybersecurity resources. For backup planning, the practical measure is specific: evidence that essential information can be recovered.

A green dashboard is helpful. A documented, successful restore gives that green light meaning.