A backup you have never restored is a hope, not a plan.
Almost every practice has backups. Far fewer can say when a restore was last tested, how long a full recovery would actually take, or whether the backup itself could be reached by the same attack.
The questions that separate a backup from a recovery plan
How much can you lose?
Your recovery point objective — how much work the organization could afford to redo. There is no correct number; it depends on your operations, your regulatory obligations and your risk tolerance. Most practices have simply never been asked.
How long can you be down?
Your recovery time objective — how quickly critical systems need to be back. This should be set deliberately from operational impact and risk, not inherited from a vendor’s default. Restoring from cold backup often takes far longer than people assume.
Can the attack reach the backup?
Ransomware looks for backups first. If yours is reachable with the same credentials as production, it is not a backup. Immutable and offline copies are the difference between an incident and a closure.
Encrypted, layered, and tested on a schedule
- Local copy for fast restores of a file, a folder or a single workstation
- Encrypted offsite copy, geographically separate, with keys the practice controls
- An immutable or offline copy that ransomware cannot reach with production credentials
- Recovery objectives defined with you and agreed in writing, based on your operations rather than arbitrary numbers
- Scheduled test restores — actually performed, with the result documented and dated
- A written recovery runbook naming who does what, in what order, with what contacts
- Annual incident response exercise, which the proposed rule expects and few practices run
Anyone can sell storage. The value is in the documented, dated evidence that a restore worked — which is also what an auditor, a cyber insurer and your own peace of mind actually require.
Find out whether your backups would work
We will test a restore from your existing backups as part of the assessment, and tell you how long a real recovery would take.