On this page
Key takeaways
Backup testing in a small business is the step most often skipped. A backup you have never restored is a hope, not a plan. Check daily that backups completed, test a restore monthly, and keep at least one copy separate from your main systems, as NCSC guidance advises. These checks outsource easily; deciding what to back up stays with you.
- Check backups completed every day.
- Test a restore at least monthly.
- Keep a copy separate from your main systems.
- Know how long a full restore would take.
Not sure your backups would work? Message us on WhatsApp.
Chat on WhatsApp →Why do backups fail when they are needed?
Backups stop silently when storage fills, passwords change or software updates. Some never included the right data. Others are stored on the same network as the originals, so ransomware encrypts both. Only a restore test proves a backup works.
What does a backup check routine look like?
Daily: confirm each backup job completed and investigate failures. Monthly: restore a sample of files and one system to a test location and check they open. Quarterly: review what is backed up against what the business now uses, including cloud apps, which do not always back themselves up the way owners assume.
- Daily: confirm completion.
- Monthly: test a restore.
- Quarterly: review scope.
- Yearly: rehearse a full recovery.
Which backup work can be outsourced?
Monitoring backup jobs, investigating failures, running restore tests, keeping a log and reporting monthly. The business decides what must be backed up, how often, how long recovery can take and who can authorise a restore of sensitive data.
Want a backup check log template? Message us on WhatsApp.
Chat on WhatsApp →What is the 3-2-1 backup rule?
A widely used rule of thumb: keep three copies of important data, on two different types of storage, with one copy off-site or offline. It is not a legal requirement, but it reflects the NCSC's advice to keep backups separate from your main systems so a single incident cannot destroy everything.
What does this look like in practice?
A pattern we see: an owner is confident backups run, but the first restore test shows a key folder was never included. Monthly tests find these gaps while they are harmless.
Backup checklist
Keep a record of each.
- Daily completion check.
- Monthly restore test.
- Separate or offline copy confirmed.
- Cloud apps included in scope.
- Recovery time known.
- Restore authorisation rules.
Next step
Tell us what you back up and when you last tested a restore. We will suggest a routine and say what checking it would involve.
Message us on WhatsApp, or book a 30-minute consultation.
Chat on WhatsApp →Sources and further reading
- Small organisations guide to cyber security · National Cyber Security Centre
- Small Business Guide: response and recovery · National Cyber Security Centre
Frequently asked questions
How often should a small business test its backups?
Check daily that backup jobs completed, test restoring a sample of files at least monthly, and rehearse a full recovery of key systems at least once a year. A backup that has never been restored cannot be relied on.
What is the 3-2-1 backup rule?
A common rule of thumb: keep three copies of important data, on two different types of storage, with one copy off-site or offline. It helps ensure that a single failure, theft or ransomware attack cannot destroy every copy.
Do cloud apps back up my data automatically?
Not always in the way owners assume. Many cloud services protect against their own outages but offer limited recovery from accidental deletion or ransomware. Check each service's retention and restore options, and add separate backups where needed.
Written by
Global Bridge Labs (GBL) is a UK–Sri Lanka partner for social media, websites and BPO. Everything here comes from client delivery, not theory.
