Managed backup: the 30-minute restore test that proves it

• A completed backup is not a recoverable backup The automatic notification says the backup ran; it does not say whether it opens, or how long it takes to get operations back.
• Half an hour is enough An old document you choose, a deleted message and, if there is a server, booting an isolated copy.
• 3-2-1-1-0 Three copies, two media, one off-site, one that cannot be deleted, zero errors in the latest test.
• Rhythm Monthly, quarterly and annual tests, depending on depth.

• Gaps in scope The billing system, a folder created last month or a partner's email were never in the plan.
• The copy is damaged Incomplete or corrupted, without anyone ever having opened it.
• The attacker got there first Spent days inside the network and destroyed or encrypted the backups before launching the attack.
• The know-how walked out the door Credentials, licences and restore steps were in a former employee's head.
• Recovery takes too long The data is on a disk kept elsewhere or in a low-bandwidth cloud, and getting back to work takes days.

Leading authorities point the same way. CISA, in the United States, recommends in its ransomware guide encrypted, offline copies of critical data, with periodic integrity and availability tests. The UK's NCSC has set out specific principles for backups that resist ransomware.

Book half an hour with your provider, in person or by video call with screen sharing. The golden rule: the board chooses what gets restored.

1. Minutes 0 to 5: what is covered: ask for the list of what is protected (servers, PCs, Microsoft 365, databases, management software) and, more importantly, the list of what is not.
2. Minutes 5 to 12: a three-month-old document: an invoice or contract from that time, recovered to a separate location. Confirm it opens.
3. Minutes 12 to 18: a deleted message: in a mailbox you choose. In Microsoft 365, this is where you find out whether there is a dedicated backup solution or only Microsoft's native retention, a topic we explain in Microsoft 365 backup: what most companies are missing.
4. Minutes 18 to 26: a server booting: a copy started in an isolated environment, without touching production. Watch it boot, open the main application and note how long it took.
5. Minutes 26 to 30: the vault: see where the off-site copy is held, confirm immutability and the number of retention days. Keep the report.

If one of the steps does not fit in the half hour, you have already learned something. It is no cause for alarm; it is a fix to be made, with a set date.

What the report must record

• Author and date Day, time and responsible engineer.
• Items and times Each element recovered, with its duration.
• Problems Errors detected and the deadline for fixing them.
• Off-site protection Proof that an external copy and an immutable copy exist.

What an immutable copy is: think of a safe with a time lock. The copy goes in and, until the period ends, nobody can delete or modify it, whether the provider, an administrator or someone with stolen credentials. It is the last line of defence against ransomware.

These tests also validate the two limits the business must know: how long it can be down and how much work it can lose. How to set those values is explained in a disaster recovery plan for an SME.

In the IT audit and consultancy for the France Affiches group, a large-format printer based in Antony, near Paris, DataRoad carried out an on-site inventory of network and systems. It assessed servers and virtualisation, privileged accounts and former employees' accounts, workstation protection and backups. The criterion was unambiguous: verify that backups restore, not just that they run.

The board received a written, prioritised diagnosis: risks to fix now, technical debt to schedule and what works and needs no investment. In essence, the half-hour drill applied to the entire infrastructure.

With DataRoad managed backup the proof restore is standard procedure. We monitor every failed backup, keep an off-site, immutable replica and document every test. In a serious incident, whoever handles business data recovery already knows every copy and where it is; and the guide to the first hours after losing data tells you what to do until then.

With the IT Unlimited Premium plan on-site support is unlimited: if an engineer is needed at the office to recover, the visit is included.

In 5 working days we run the 30-minute drill with you, assess your infrastructure against 3-2-1-1-0 and leave you, in writing, the measured recovery times and fixes in order of priority. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and phone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

• CISA: #StopRansomware Guide
• NCSC (United Kingdom): Ransomware-resistant backups