In summary
- A backup is only as good as the replacement. “Running successfully” means that the copy was made — not that it works when you need it.
- Ask your provider for a 30-minute test in front of you: restore an old file of your choice, an erased email, and, if you have a server, extract a copy of the server in an isolated environment.
- Rule 3-2-1-1-0: 3 copies, 2 types of support, 1 off-site, 1 that cannot be deleted and 0 errors in the final test.
- Minimum frequency: one quick test per month, one server replacement per quarter, and one full test per year.
In this article
The backup test It is the only way to know if your company can recover from ransomware, a hardware failure, or a human error. Most administrations receive an automatic email when they receive it saying “backup complete”. This email confirms that a copy has been made. It does not confirm that the copy is complete, that it can be opened, or how long it takes for the company to get back to work.
The good news: you don't need to be tech savvy to demand proof. You need 30 minutes, a list of specific requests, and a vendor willing to do it in front of you.
Because a “green” backup can fail
The most common reasons why a replacement fails on the day it is needed:
- Something was left out: a new folder, a billing database, an administrator's mailbox.
- The copy is corrupt or incomplete and no one has opened it since it was created.
- The backup was deleted or encrypted by the attacker, He had access to the network for days before he showed himself.
- No one knows how to restore it: The passwords, the licenses or the procedure were in the head of someone who has already left.
- The replacement takes days, Because the copy is on a slow cloud service or on a disk that has to be transported.
Cybersecurity authorities say the same in other words. The CISA ransomware guide, the U.S. cybersecurity agency, recommends keeping offline and encrypted copies of critical data and regularly testing their availability and integrity. The NCSC, the UK cybersecurity center, has published specific principles for ransomware-resistant backups.
The rule 3-2-1-1-0, in simple English
| Number | What it means | Question to ask the supplier |
|---|---|---|
| 3 | Three copies of the data: the original and two more | “Where are the two copies besides the original?” |
| 2 | In two different types of support (for example, local disk and cloud) | “If the backup equipment breaks down, what is the other copy?” |
| 1 | A copy outside the company's premises | “If the office burns down, where do I put it?” |
| 1 | A copy that cannot be deleted or changed during a defined period | “Can an attacker with the administrator password delete it?” |
| 0 | Zero errors in the last replacement test | “When was the last test and where is the report?” |
The 30-minute test that you should ask for
Schedule a half-hour meeting with the supplier, in person or via a video call with screen sharing. The requests are yours — don't let the supplier choose what to deliver.
- Minutes 0–5 — the inventory. Ask for the list of what is protected: servers, computers, Microsoft 365, databases, management applications. Ask what is not.
- Minutes 5–12 — an old file. Choose a document that existed three months ago (an invoice, a contract) and ask that it be placed in a separate folder. Open it.
- Minutes 12–18 — an email deleted. Request the replacement of a message deleted from a mailbox of your choice. If you use Microsoft 365, this step shows whether there is a custom backup or just Microsoft's recycling — we explain the difference in The Microsoft 365 backup that almost no company has.
- Minutes 18–26 — the server. If you have a server, have someone take a copy in an isolated environment, without touching the original. See if it works and open the main application. Note how long it took.
- Minutes 26–30 — the copy that does not erase. Ask to be shown where the copy is outside the company, if it is immutable and for how many days. Request the written report of the test.
If any step is not possible within 30 minutes, that is already a response. It is not a reason for immediate alarm, but it is a point that needs to be corrected within a specific timeframe.
What you should receive in writing
- Date, time and who performed the test.
- What was restored and how long each restoration took.
- Found errors and estimated date for correction.
- Confirmation that there is a copy outside the company and that the copy is immutable.
How often to test
| Test | Minimum frequency | Who participates |
|---|---|---|
| Repositioning of files and emails chosen at random | Monthly | IT Supplier |
| Booting a server or virtual machine in an isolated environment | Quarterly | IT provider, with report to management |
| Complete recovery test (the above 30-minute test) | Annually | IT and administration provider |
| Additional test | After any major change: new server, migration, new application | IT Supplier |
The tests also serve to confirm the two numbers that matter to the business: how long the company can withstand downtime and how much work it may lose. We explain how to define them in the article about Backup and disaster recovery for SMEs.
A real case: on-site audit in France Affiches
Na IT audit of the France Affiches group, DataRoad, a large-format French graphic design company based in Antony in the Paris region, traveled to the facility to install the network and systems on site. Among the points examined were the servers, virtualization, privileged and ex-employee accounts, computer protection, and backups—with a clear criterion: to verify that the copies can be restored, and not just that they have been run.
The result is a written report, with priorities: immediate risks, technical debt to plan for, and what is good and does not need investment. It is the same principle as the 30-minute test, applied to the entire infrastructure.
How we work with backups in DataRoad
In our managed backup solution, Reproving is part of the routine; it is not an extra service. We monitor copy errors, maintain off-site copies and immutable copies, and document the tests. If the worst happens, the team of data recovery he knows exactly what exists and where — and the article about the first hours of a data recovery explains what to do until then.
No IT Unlimited Premium, On-site assistance is included — if a recovery requires someone in the office, there are no separate chargeable travel expenses.
Frequently Asked Questions
My provider says that the backup runs every day. Isn't that enough?
No. Running every day proves that the copy was created, not that it can be restored. Only a restore test, with a recorded result, confirms that the data is complete and how long it takes to recover it.
Can the replacement test corrupt the original data?
No, if it is done well. The files are reposted in a separate folder and the servers are booted up in an isolated environment, without connection to the production system. The original is never touched.
How long does it take to replace a server?
It depends on the volume of data and where the copy is located. The important thing is that this time is measured and compatible with the time the company can withstand downtime. If the test shows that it takes a day and the company can only withstand two hours, a decision has to be made.
What is an immutable backup?
It is a copy that, once recorded, cannot be deleted or altered for a defined period — neither by an administrator nor by an attacker with stolen passwords. It is the most effective protection against ransomware that attempts to destroy backups.
Replacement test accompanied within 5 working days
We perform the 30-minute test with you, apply the 3-2-1-1-0 rule to your infrastructure, and deliver a report with real recovery times and priority fixes. For companies with more than 10 seats · support contract · remote, on-site, and telephone support.
Accompanying replacement test
Real recovery times and report in 5 working days
![mun[it] logo, a digital marketing agency — a DataRoad client](https://www.dataroad.pt/wp-content/uploads/2026/09/logo-cliente-munit.png){kind=logo}
