Cybersecurity Awareness Month, week 2: Can you actually recover your files?
Last week, we focused on checking multifactor authentication across your business email accounts. This week, the action is to recover one important file from a backup and confirm that you can use it.
Think about a document your team would struggle to work without. It might be a spreadsheet used for billing or a folder of current project information. If someone accidentally deleted it this afternoon, who would you call, and what version could they bring back?
A short restore test gives you a concrete answer for the file you choose. It also gives you a chance to find problems while the original is still available and your employees can keep working.
A backup notification is the starting point
A successful backup notification is useful evidence that a backup job completed. The next question is whether it captured the information you need and whether that information can be recovered in a usable form.
CISA's ransomware guidance recommends regularly testing the availability and integrity of backups. Recovery also matters when the problem is an accidental deletion or a failed computer.
For this week's exercise, ask whoever manages your backups to help you restore a file. Keep the test small enough to complete and review together.
Choose a file that matters to your business
Pick a document or spreadsheet that someone on your team knows well. Familiarity helps because that person can tell whether the restored content looks right.
Choose something representative of your daily work, with a known change you can look for. For example, you might select an internal project spreadsheet and check whether the restored version contains the entries you expect from the date of the backup.
Identify where the original lives and ask your IT provider to confirm that location is included in the backup plan. A file saved on an employee's desktop may have different protection from one stored on a shared server.
NIST's small business guidance recommends testing backups to confirm that the data can be restored. Start with a straightforward file for this exercise. Business databases and accounting applications need a test appropriate to the application.
Restore a separate copy and open it
Have your IT provider restore the selected file into a separate, clearly labeled test location. Keep the original in place. There is no need to delete a working file to test whether a backup can restore it.
Use an approved business location with appropriate access restrictions, especially if the file contains client information. Ask the employee who normally works with it to open the restored copy and check:
- Does it open in the expected application without errors?
- Does the content match the backup date you selected?
- Are the expected pages, spreadsheet tabs, or other relevant details present?
- Could the employee use this copy to continue the work?
Seeing the filename appear in a folder is only the first part of that check. Someone familiar with the contents should review the recovered file before you record the test as successful.
Check the age of the backup and the recovery time
Record which backup was used and how long the recovery took, including the time needed to locate it and make the restored file available.
The age of the backup determines how much recent work may be missing. If your available copy is from Monday evening and the file is lost on Thursday, work completed after that backup may need to be recreated.
Recovery time matters too. Ask whether the wait would be acceptable if your team needed the file to finish today's work. NIST NCCoE's guidance for managed service providers includes evaluating file usability, retrieval and restoration time, and gaps in the recovery process.
If the test reveals a problem, assign someone to address it and set a date to repeat the test.
Understand what you have tested
A successful file restore demonstrates that you recovered that file from that backup under the conditions tested. It does not establish how quickly your entire business could recover from a server failure or ransomware incident.
Broader recovery testing needs to account for applications, permissions, and the systems they depend on. Use this week's result as a starting point for that discussion with your IT provider.
The same question applies if your files are in cloud services: what recovery protection is configured, and how do you use it? The UK National Cyber Security Centre advises businesses to understand how they can access and restore their critical cloud data. It also warns against relying only on version history or deleted-file retention instead of keeping an independent backup of critical data.
Your action for this week
Send this request to whoever manages your backups:
"Can we restore one important business file to a separate test location this week? I would like to confirm that it opens correctly, which backup it came from, and how long recovery takes."
Keep a short record of the test date, file, backup date, recovery time, and result. Include an owner and due date for any follow-up work, then agree on the next test date.
Next week, we will focus on checking software updates across your business.
Sources
- CISA, StopRansomware Guide: testing backup availability and integrity.
- NIST, Small Business Information Security: testing data restores.
- NIST NCCoE, Protecting Data From Ransomware and Other Data Loss Events: evaluating file usability, recovery time, and process gaps.
- UK NCSC, Back up your organisation's critical data: cloud recovery planning.