A Backup You Haven’t Restored Is a Hope, Not a Backup
Backups are the most-ticked, least-tested box in small business. ASD’s guidance says to test restores regularly - here’s why almost nobody does.
I once stood in a server room while a team discovered that the backups they’d trusted for months couldn’t be restored. The job had run every night. The logs said success. The little green ticks had been ticking away faithfully - backing up a mounted volume that had silently stopped containing the data. Nobody had ever tried to get a file back, because getting files back wasn’t anyone’s job. Backing up was.
That distinction - backing up versus getting back - is the whole subject, and almost every small business is on the wrong side of it.
The most-ticked, least-tested box
Ask an owner "do you have backups?" and you'll get a confident yes. The NAS in the cupboard, the cloud sync, the external drive someone plugs in on Fridays. Ask the follow-up - "when did you last restore something from it?" - and the confidence drains out of the room. The honest answer, nearly always, is never.
That's not carelessness; it's a category error. A backup that runs isn't an outcome. It's a procedure. The outcome you're actually buying is restoration - your files, your accounting data, your customer records, back in your hands within a timeframe you can survive. Until you've done a restore, you don't own that outcome. You own a green tick and a feeling.
The Australian Signals Directorate says this plainly in its small-business cloud security guidance: "Regularly test that your backup solution can effectively restore your important data, software and configuration settings" (ASD, Technical example: Regular backups, 2026). It's right there in the official advice. It's also the half of the advice that doesn't ship with the product, so it's the half that doesn't happen.
Two questions before any product
Forget the technology for a moment and answer two questions in plain English. How much work can you afford to lose - an hour, a day, a week? And how long can you afford to be down while you get it back - an afternoon, two days, a fortnight? The continuity industry dresses these up with acronyms, but they're just those two questions, and your answers decide everything: how often the backup runs, where the copies live, and whether your current arrangement is adequate or theatre.
Most owners, answering honestly, say "a day" and "a day or two". Then they look at their actual setup - a sync service they've half-confused with a backup, and a drive that hasn't been checked since installation - and realise the setup answers "unknown" and "unknown".
While you're there, count your copies. The old rule of thumb still earns its keep: more than one copy, on more than one kind of storage, with at least one somewhere else - ASD's own backup guidance describes exactly this shape, down to the off-site copy. The reason for "somewhere else" is unglamorous: the fire, the flood and the burglar take the cupboard NAS along with the computers it was protecting.
And one copy needs to be beyond the reach of your own systems. Ransomware crews learned years ago to encrypt the backups first - a backup drive permanently plugged into the machine it protects is one bad click from becoming part of the problem. Offline, or in a cloud service with versioning the malware can't reach, is the difference between an incident and an ending. The recoveries I've watched succeed had one boring thing in common: a copy the attacker never touched.
The twenty-minute drill
Here's the entire fix - how to test your backups, in full - and it costs nothing. Pick a file you'd miss - this quarter's invoices, the customer list. Restore it. Not "confirm it's in the backup" - actually bring it back, to a different machine if you can, and open it. Time the process. Note where you got stuck, because where you got stuck at 2pm on a calm Tuesday is where you'll be stuck at 2am on the worst night of your business life, minus the calm.
Then put the drill in the calendar, quarterly, alongside the rest of the availability basics your continuity thinking belongs to. Twenty minutes, four times a year. If that ever feels like too much, run the comparison: every recovery I've been near was measured in days and despair or in minutes and relief, and the only variable that predicted which was whether anyone had rehearsed.
The life ring on the wall looks exactly the same whether or not it floats. There's one way to find out, and you get to choose whether you find out on a sunny day. When did you last throw yours in?
Sources
- Australian Signals Directorate, Technical example: Regular backups (Small Business Cloud Security Guide) - retrieved 13 June 2026
- Australian Signals Directorate, How to back up your files and devices - retrieved 13 June 2026
- Red Bridge Cyber, perspective: The Third Word in the Definition of Security