A backup status tells you something about a copying process. A restore exercise tells you something about recovering work. A small business needs to understand both.
Start with a modest question: can an authorised person recover one harmless document and use it for the task it supports? This can make the next recovery discussion much more concrete.
The official starting point
The NCSC’s small-organisations guidance recommends backing up the information needed to operate. It also says to know how to restore backups and check that important data is included. [1]
The exercise below is a READY/ planning suggestion built around that objective. Use your actual backup provider’s procedure, or arrange the exercise with the person responsible for your IT. It is not an instruction to alter a production system.
Choose a small, non-sensitive example
Use a harmless test document with an identifiable version. Decide what you expect to recover before you start. A blank template with a clearly recorded test revision can be sufficient; there is no need to use customer records or financial information.
Choose an ordinary task the recovered file should support. “The file appears in a folder” is a weaker outcome than “the authorised person opened the expected version in the application they need”.
Avoid testing every system at once. You want a result you can explain and a clear list of what remains outside the exercise.
Recover without disrupting working data
Follow the provider’s documented process. Recover to a separate location and leave the working original alone. If you are unsure about the procedure, ask the provider to arrange the test rather than guessing through unfamiliar controls.
Do not delete or damage live files to manufacture a convincing scenario. Do not switch off security measures or share passwords to make a test succeed. Record any access problem as a finding for the responsible person.
Record observations, not a general pass
Use this suggested log:
| Observation | What to record |
|---|---|
| Recovery target | Test file and expected version |
| Person | Who was authorised to perform the exercise |
| Procedure | Where the actual instructions were found |
| Result | Version returned and whether it opened correctly |
| Time | Observed start and finish for this exercise |
| Open issue | Permission, application or instruction needing attention |
Keep recovery secrets out of the log. The note should identify where authorised people obtain instructions, rather than becoming another exposed store of credentials.
Say what the result establishes
“One test document recovered and opened” is a useful result. It does not prove that every file, account, application, device or business process can be recovered, or establish how long a complete recovery would take.
Use the finding to choose a next step with your IT provider. Perhaps the instructions were easy to find but only one person could use them. Perhaps the file returned but the required application was missing. Those are concrete operational questions.
The outcome is a better recovery conversation: what was demonstrated, what remains untested and who owns the next action.
Run the free Business Downtime Test →