A backup you have never restored is a hope, not a plan

Monday morning, and the shared folder with every signed customer contract is gone. A sync client deleted it, or something encrypted it, or a departing employee tidied up a little too thoroughly. Somebody says the reassuring sentence: we have backups.

Then the questions start. Which backup? Where is it? Who has the password? How long does a restore take? Is that folder even in it? The answers arrive on Thursday, and one of them is that the folder was added to the shared drive after the backup job was configured.

The real cause is that backup gets bought as a product and judged by whether the nightly job reports success. A green tick says that some data was copied somewhere. It says nothing about whether you can get it back, how long that takes, or whether the thing you just lost was ever included.

How backups fail on the day they are needed

Never restored. The job succeeds every night and nobody has ever brought anything back. The first real restore is also the first test, and it happens under pressure, with the business waiting.

Same keys as production. The backups can be reached with the same administrator account as the systems they protect. Anyone, or anything, that takes over that account can delete the backups first. Ransomware operators are well known to look for them before they encrypt anything else.

The cloud is assumed to be the backup. Mail and documents in a cloud suite are replicated by the provider for the provider’s own availability. That is not the same thing as a copy you control and can restore from after a deletion, a sync error or a compromised account. Read what your provider’s terms actually say about deleted items and retention, instead of assuming.

Data without configuration. The files are safe, but the server they lived on, the permissions, the directory and the firewall rules are not. Restoring data onto nothing takes far longer than restoring data.

Nobody knows the restore time. The business asks how long it will take, and the honest answer is that we will find out. Two numbers matter here — how much recent work you can afford to lose, and how long you can afford to be without the system — and in most companies neither has ever been written down.

What a backup you own looks like

Several copies, one out of reach. The long-standing 3-2-1 rule still holds: three copies, on two kinds of media, one of them off-site. The modern addition is that at least one copy is immutable or offline, so nothing on the production network can delete it.

Separate credentials. Backup administration runs on its own accounts with their own second factor, not on the everyday administrator account, and those credentials are stored where the recovery team can find them when the main systems are down.

Your own copy of cloud data. Mail, documents and chat backed up to storage the company controls, so the copy does not depend on the very account you might be locked out of. It is the same question as pricing the exit: what can you actually get out, and in what shape.

Configuration backed up too. Directory, firewall and switch configuration, server builds: exported or written down, so a restore has somewhere to land.

Two numbers agreed with the business. For each key system, how much data loss is tolerable and how long an outage is tolerable. They decide the backup frequency and the restore design, not the other way round, and they are decided by the people who run the business rather than by whoever configured the job.

A scheduled restore. Every quarter, a real restore of something chosen at random, timed and written down, including what went wrong. The written record is what turns a backup into a plan.

None of this is glamorous, and all of it belongs to the company rather than to a product. It is part of what we mean by owning your IT instead of renting it: an estate designed to keep working when a supplier, an account or a person does not. And if the only person who knows how the restore works is the one on holiday, the problem is the one described in your continuity plan is one person.

The test

Pick one file that was last changed about three months ago, and one mailbox. Restore both today to a different location, and time it from the moment you start until somebody confirms the content is right.

Then answer one more question: could the account you just used also have deleted the backups?

If the restore took more than a working day, or the answer to the second question is yes, you have found the most valuable piece of IT work your company can do this quarter, and it did not cost anything to find.