A green tick beside a backup job is reassuring, but it does not prove that your business could actually recover from an incident.
For a small business, the important question is not simply “Are we backing up?” It is “Could we restore the right data, quickly enough, when we really need it?”
That difference matters. Backups can complete successfully while still leaving gaps: the wrong folders may be protected, retention may be too short, cloud data may be excluded, or nobody may have tested a full restore.
Why a successful backup is only half the job
Backup systems are designed to copy data. Recovery is about getting the business operational again.
Those are not the same thing.
A useful backup strategy should answer four practical questions:
- What is protected? Servers, laptops, Microsoft 365, shared files and line-of-business systems should all be considered.
- How much data could we afford to lose? This is your recovery point requirement.
- How quickly do we need systems back? This is your recovery time requirement.
- Has anyone actually tested the restore? If not, you are relying on an assumption.
1. Test a real restore
The simplest way to build confidence in a backup is to restore something from it.
That does not have to mean rebuilding an entire server every month. A sensible test could be:
- recovering a deleted file to an alternate location;
- restoring a mailbox item or folder;
- recovering a virtual machine into an isolated test environment;
- checking that an older version of a document can still be retrieved;
- confirming that application data opens correctly after recovery.
The test should prove not only that the restore starts, but that the recovered data is usable.
2. Check what is not being backed up
One of the most common problems is assuming that everything important is covered.
For example, a business may protect its on-premises file server but overlook:
- Microsoft 365 mailboxes;
- OneDrive and SharePoint data;
- files stored locally on laptops;
- cloud applications;
- configuration data for key systems;
- important data held by third-party suppliers.
It is worth creating a simple list of where business-critical information actually lives, then mapping each location to a backup or recovery method.
3. Do not confuse Microsoft 365 retention with backup
Microsoft 365 includes useful retention and recovery capabilities, but businesses should still decide whether they need an independent backup for Exchange Online, OneDrive, SharePoint and Teams data.
The key question is whether the built-in recovery options match your required retention period, restore flexibility and business continuity needs.
This is especially important where accidental deletion, malicious deletion, ransomware or a compromised administrator account could affect large amounts of cloud data.
4. Think about ransomware recovery
Modern ransomware incidents are not limited to encrypting files. Attackers may also try to delete backups, compromise cloud accounts or disable security tools.
A stronger recovery design therefore includes separation between production systems and backup systems.
Useful controls can include:
- immutable or protected backup copies;
- separate administrative credentials;
- multi-factor authentication;
- off-site or logically isolated copies;
- retention long enough to recover from an incident discovered late.
Your backup should still be available even if your normal network or administrator account has been compromised.
5. Measure recovery time, not just backup time
A nightly backup may complete in minutes, while a full recovery could take many hours.
If your business depends on a server, application or internet-based system, consider how long you could realistically operate without it.
For example:
- Could staff continue working if the file server was unavailable for a day?
- Could customer calls continue if the phone system failed?
- Could you access key contacts and documents if Microsoft 365 was unavailable?
- How long would it take to replace and rebuild a failed laptop for a critical user?
These questions help turn backup from a technical task into a business continuity plan.
6. Keep the recovery instructions somewhere safe
During an incident, the person who normally manages the system may be unavailable, locked out or dealing with several problems at once.
Document the essentials:
- who provides the backup service;
- who has administrative access;
- how support is contacted;
- where recovery credentials are stored;
- which systems should be restored first;
- who has authority to approve a full recovery.
Keep a copy somewhere that does not depend entirely on the systems you may be trying to recover.
A simple backup health check
For most SMEs, a useful review can start with five questions:
- When was the last successful backup?
- When was the last successful restore test?
- What important data is not currently protected?
- How long could the business operate without its main systems?
- Could the backups survive a compromised administrator account or ransomware incident?
If any of those answers are unclear, the backup strategy probably needs another look.
Backups are about recovery, not green ticks
A good backup system should give you confidence that the business can recover, not simply produce a successful job report every morning.
ML Services helps businesses across Sussex review backup, Microsoft 365 protection and disaster recovery arrangements, including practical restore testing and recovery planning.
If you are not sure whether your current backups would stand up to a real incident, contact ML Services and we can review what is protected, what is missing and how quickly you could realistically recover.