How to Test Your Backups Before the Next Storm

Someone set up a backup years ago. Every night it runs, and every morning there is a little message that says it finished. So you assume your files are safe.

Then the question comes at a bad moment: a storm is on the way, a laptop won’t start, or an important mailbox has been deleted. Could you really get everything back? And how long would it take?

A backup you have never restored from is a backup you are only hoping works. A ransomware attack (software that locks your files and demands payment), a dead computer or a storm is the wrong time to find a gap. The only way to know is to test a restore, and this guide shows how to start.

Why Isn’t Having a Backup Enough?

A backup only helps if it survives the problem and actually restores. Several things can get in the way.

Attackers go after backups too. In a 2024 survey by Sophos, a company that sells security software, 94% of organizations with 100 to 5,000 employees that were hit by ransomware said the attackers tried to compromise their backups. The ransomware guide from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) notes that many ransomware strains try to find and delete or encrypt the backups they can reach.

Ransomware reports are common. The FBI received more than 3,600 ransomware complaints in 2025. Outside the critical sectors, the most complaints came from legal services and contractors.

A copy in the office shares the office’s risks. When the only copy sits next to the computers it protects, the storm or outage that takes out the office takes out the copy too.

That is why our backup service is built around testing, not just copying.

Is OneDrive or Google Drive a Backup?

Not on its own. These services keep your files in sync across computers. That is handy, but it also means a file deleted or damaged on one computer can be deleted or damaged on the others too.

Recovery windows are also limited. Google, for example, says an administrator can recover Drive files for 25 days after a user empties their trash. After that, they can’t be recovered that way.

A separate backup keeps older copies that you control. If you rely only on syncing, you may have less protection than you think.

How to Test Your Backups: A Simple Restore Test

A restore test means getting real data back out of the backup and checking that it works. You can run a small one yourself, or ask whoever manages your backups to do it with you watching.

1. Pick something real. Choose a client folder or a spreadsheet you use every week, something you would miss. A mailbox restore usually needs your backup provider’s help.
2. Restore it to a different place. Put it in a new folder, not over the original, so the test copy and your working files stay separate.
3. Open it. Do the files open? Are they the latest versions, or are they months old? Is anything missing?
4. Time it. Note how long it took from “let’s restore” to “it’s open and usable.”
5. Write it down. Record the date, what you restored, which backup it came from, how long it took and anything that failed.

Be honest about what one test proves. A restore test shows that the data you tested came back on the day you tested it. It doesn’t prove that every file will come back in every situation. CISA advises regularly testing that backups can be restored, so put the test on a schedule rather than doing it once.

What Should a Small Business Backup Plan Cover?

Once you have run one test, look at the bigger picture. A useful plan answers these questions:

• What is backed up, and what isn’t? Think about computers, shared files, email and the business software you rely on.
• Where do the copies live? CISA advises keeping offline, encrypted backups of critical data. “Offline” means a copy that isn’t connected to your everyday network, so it is harder for an attacker who gets in to reach.
• Can the backups be erased? Some backup services let you lock copies for a period, during which nobody can change or delete them. Ask whether yours does, and whether it is turned on.
• Who hears about a failed backup? An alert nobody reads doesn’t help.
• How long would a full restore take? Get a realistic estimate before you need it.

If your practice is covered by HIPAA, the Security Rule requires a data backup plan and a disaster recovery plan. Testing those plans is listed as “addressable,” which means you either do it or write down why an equivalent alternative is reasonable. Your compliance advisor can explain how that applies to your practice.

A dated record of restore tests is also something you can show your insurer, your auditor or your partners. If your insurance form asks security questions you aren’t sure how to answer, see our page on cyber insurance renewal.

Backup Checklist for This Week

Most of this is a few questions and one small test:

• Ask whoever set up your backups to show you what is covered, and what isn’t.
• Find out where every copy is kept. Is at least one copy away from your office?
• Ask when a restore was last tested. If nobody knows, that is your answer.
• Run the five-step restore test above on one folder, and ask your provider to restore one mailbox.
• Check whether you get an alert when a backup fails, and who reads it.
• If you use OneDrive or Google Drive, ask whether there is a separate backup as well.
• Write down the date and the results, and put the next test on the calendar.

Backups are only one part of getting ready for a storm. For the rest of your plan, see hurricane-proof your data.

Get a Free Backup Gap Call

Not sure where your gaps are? Ask for a free backup gap call. We talk through what gets backed up, where the copies live, the last time anyone tested a restore and whether an attacker could wipe them. Afterwards you get a plain summary of the gaps we heard about and what to check first. It costs nothing, and there is nothing to buy. Please don’t send passwords.

To see how protected copies, quarterly restore tests and dated reports work together, read about backups you can prove. Something else on your list? Pick a free check.