Practical guides

A successful backup job is not proof of recovery.

Recovery planning needs evidence that an important service can return to useful operation, with the people and dependencies it requires.

A backup status answers a useful question about a particular job. An organization usually needs to answer a broader one: can we restore the service and resume the work that depends on it?

CISA recommends keeping offline, encrypted backups of critical data and regularly testing their availability and integrity in a recovery scenario. NIST's preparation guidance likewise calls for planning, implementing and testing a backup and restoration strategy. These are activities to demonstrate, not just settings to select. [Sources 1 and 2]

Use the next discussion with your IT provider to ask five practical questions:

What is included?

Identify the application, information, configuration and other components needed for a useful restoration.

Who can perform recovery?

Identify the people, access and provider assistance needed if ordinary sign-in or communication methods are unavailable.

What would be restored first?

Agree the business priorities and dependencies before an interruption forces the decision.

What was actually tested?

Ask for the date, scope, steps, results and remaining issues from the most recent relevant exercise.

How does the business confirm success?

Opening a restored file and resuming an end-to-end business process are different checks. Decide which functions the exercise should demonstrate.

A focused recovery exercise should have an agreed environment, method and operating boundary. Plan it with the people responsible for the systems rather than improvising on a production service. Use the result to identify specific improvements and the next exercise.