Almost every business says it has backups. Far fewer can say, with confidence, how long it would take to get back to work if their main server died tonight or ransomware encrypted every shared drive in the office. Doug Roberts, chief technology officer of Cytranet, says that gap between having a backup and knowing a restore will work is where many businesses get hurt.
“A backup you have never restored from is a hope, not a plan,” Roberts said. “The only way to know is to actually do it, on a calm Tuesday, before you are forced to do it during the worst week of the year.”
Why backups fail when they are needed
Backups rarely fail in dramatic ways. More often they fail quietly. A job stopped running months ago after a password change. A new file share was never added to the backup set. The backup completed, but the files turned out to be incomplete. Or the data is all there, but nobody remembers the steps needed to rebuild the server it came from.
Ransomware adds another wrinkle. Modern attacks often look for backup systems and try to encrypt or delete them too, so copies that sit on the same network as production systems may not survive. Isolated or immutable copies, stored where an attacker cannot reach them easily, have become a standard recommendation for good reason.
“People tend to think about backups as a storage problem,” Roberts said. “Recovery is really a people and process problem. The storage part is the easy half.”
What a restore rehearsal looks like
A restore test does not have to be elaborate. Roberts suggests businesses start small and build up:
- File-level tests: pick a handful of files or folders at random each month and restore them to a separate location. Confirm they open and are current.
- System-level tests: periodically restore a full server or application to an isolated environment and confirm that it boots and works.
- Timed tests: measure how long a full recovery takes, from the moment someone decides to restore to the moment staff can work again.
- Tabletop exercises: walk through a scenario, such as ransomware on a Friday night, and ask who gets called, who decides and what happens first.
The timed test is often the eye-opener. Many businesses discover that pulling a large amount of data back over an internet connection takes far longer than they assumed, or that a critical application depends on something that was not backed up at all.
Match the test to the business
Two numbers help frame any recovery plan: how much data a business can afford to lose, and how long it can afford to be down. A dental office, a law firm and a warehouse will answer those questions differently. Restore testing is how a business finds out whether its actual setup meets the targets it thinks it has.
“If leadership says the business can only be down for four hours, the test should prove that. If it takes two days, that is not a failure of the test. That is exactly the information you needed,” Roberts said.
For a deeper look at building the strategy behind those targets, the Cytranet blog covers why a real backup and disaster recovery strategy beats a checkbox, along with a disaster recovery checklist.
Where the backups live matters
Keeping at least one copy of critical data off site is a long-standing best practice. For businesses in Southern Nevada, a local colocation and data center facility can offer a secure, well-connected place for backup systems, close enough to reach quickly if hardware needs to be handled in person. Cloud-based copies add further distance from local events.
Roberts said the right combination depends on how fast a business needs to recover and how much data it holds. What matters most is that each location is part of the testing routine, not only the primary one.
Document it and make it routine
A recovery plan that lives in one person’s head is fragile. Roberts recommends writing down the restore steps, keeping contact lists current, and storing the documentation somewhere that will still be reachable if the main systems are down. Each test is also a chance to update those notes.
“Every time we run a restore test with a customer, we find something to improve. Sometimes it is small, like an outdated phone number on the call list. Sometimes it is a system nobody realized was important,” he said. “Either way, you would much rather learn it during practice.”
Confidence is the goal
Cytranet provides data backup and recovery alongside managed IT, network security and colocation, with 24/7 support. Roberts said the most valuable outcome of regular testing is not a report. It is the calm that comes from knowing what will happen next.
“When something goes wrong, the businesses that have rehearsed do not panic. They open the plan and start working through it,” he said. “That confidence is worth more than any piece of hardware.”
He added that the right frequency depends on how quickly a business changes. An organization that adds new systems or staff regularly should test more often, because every change is a chance for something to fall outside the backup routine without anyone noticing.
Businesses that want help assessing or testing their recovery plans can contact Cytranet to schedule a conversation.
