Most businesses that lose data had backups running the entire time. The backup they had just was not the backup they thought they had, and nobody found out until the day they needed it.
Here is how I'd find out which kind you have. None of it requires you to be technical.
Ask when something was last restored
This one question does more work than the rest of this post combined.
Ask whether someone has recently restored a real file or a real system from a backup, on purpose, and how long it took. You want a date and a duration.
A dashboard cannot answer that, which is why I start with it. Backup software reports on backups, and a green checkmark means a job finished. It does not tell you whether the contents are usable, whether the right things were included, whether a restore would finish in a timeframe your business can live with, or how much recent work you'd lose.
Only a restore tells you that. The answer that should worry you is some version of "they run every night and we'd get an alert if they failed." That describes the backup, and you asked about the restore.
Ask how long a full recovery would take
Get a number, then compare it to how long your business can actually be stopped.
This is where I see most of the bad news turn up. A backup that contains everything but takes nine days to bring back is, for most small businesses, about as useful as no backup at all.
Restoring is slower than backing up, and it competes for the same internet connection everyone else is using. It also tends to happen during the worst week of your year while people keep asking when it will be done.
The answer that should worry you is a shrug, or a number nobody has ever tested.
Ask what is not being backed up
There is always something. What a backup covers usually gets decided once, at setup, and the business keeps changing after that.
These are the gaps I see most often:
- A server or application added after the backup was set up
- Data in cloud services that everyone assumes the provider protects
- A file share someone set up on a spare computer
- Laptops holding work that was never saved to a shared location
- A line-of-business application (the main software your business runs on) that stores its data somewhere unexpected
The cloud gap catches people over and over. Your cloud provider protects itself against its own failures. It generally does not protect you if someone deletes something or a departing employee clears out a mailbox. It also won't stop ransomware from encrypting files that then sync to the cloud copy.
The answer that should worry you is "everything." No backup covers everything, and a provider who has actually looked can tell you what is excluded and why.
Ask whether a copy is out of reach
Ransomware groups now look for backups first and delete or encrypt whatever they can reach. Our case study on backups that were the first thing encrypted shows what that looks like. A business with intact backups has much less reason to pay, so removing that option is the first thing attackers do.
So ask whether at least one copy of your data sits somewhere that cannot be reached and deleted with the administrator password on your network. It can be offline, immutable (locked so it can't be changed or deleted for a set period), in a separate account, or behind separate logins. How it is set up matters less to me than the fact that it is out of reach.
The answer that should worry you is anything that means the backups live on the same network and can be reached with the same administrator account as everything else.
Two things that are not backups
Sync is not backup. A folder that syncs between computers and the cloud is a convenience, and it copies every change, including the bad ones. If you delete a file, or ransomware encrypts ten thousand of them, the sync applies that everywhere. Some sync services keep older versions for a limited time, which helps, but it still isn't a backup.
Redundant disks are not backup either. Two drives that mirror each other protect you if one drive fails. They do not protect you from deletion, corruption, ransomware, theft, fire, or someone removing the wrong thing, because each of those gets written to both disks at once.
I'd keep both. Neither one is what you'll need on the day something goes wrong.
The gap that gets missed most
The most common miss I see is email. Specifically, whether anything like a Microsoft 365 backup protects your mailboxes if one is deleted or cleared out, whether that happens on someone's last day or at the hands of an intruder covering their tracks.
Most small businesses assume this is covered because the mail is in the cloud. The retention settings in Microsoft 365 help for a limited window. After that window, for many businesses, nothing covers it.
I would check this one specifically instead of assuming. For a lot of companies, the email archive is the most valuable record they have.
The four answers you should get
You don't need to understand the technology. You need someone who can tell you, without having to look it up:
- The date of the last successful restore test and how long it took
- What is included, and what is deliberately excluded and why
- How long a full recovery would take, and how much recent work would be lost
- Where the copy lives that an intruder with your administrator password cannot delete
A provider who is doing this properly has those answers ready, because keeping track of them is part of the job.
Where I'd start
Ask for a restore test this month. When it's done, ask for the date and how long it took.
It is a small request and it costs very little. In my experience, it is also the most useful question a non-technical owner can ask about their technology, because it often turns up something nobody knew.
If you'd rather have someone check it independently, backup and business continuity is part of what our assessment covers, and you get the findings in writing whether or not you do anything else with us. Or book a free 15-minute call and I'll go through your answers with you.