How Often Should a Business Test Its Backups?

A business should test important file restores at least quarterly and conduct a broader recovery exercise at least once a year. Higher-risk businesses may need monthly restore tests and more frequent disaster-recovery exercises.

There is no universal schedule for every organisation. The correct frequency depends on how quickly information changes, how costly downtime would be and whether the business handles regulated or highly sensitive data.

The central principle is simple: a successful backup notification does not prove that the business can recover.

Why backups fail when they are needed

A backup job may display a green status while still failing to protect the information the business considers critical.

Common problems include:

• Important folders were never selected
• A new server or SharePoint site was not added
• Backup credentials expired
• Storage reached its capacity
• Files were already corrupted before being copied
• The backup is encrypted by the same ransomware
• Nobody knows the recovery password
• Restore instructions are outdated
• The available internet connection is too slow for timely recovery

These problems are often discovered only when someone urgently needs the data.

Use more than one type of test

Backup testing should happen at several levels.

Monthly automated review

An IT provider should review failed jobs, warnings, storage capacity and devices that have stopped reporting. This is monitoring rather than a complete recovery test, but it catches obvious problems early.

Quarterly sample restores

Restore several representative items, such as:

• An email
• A OneDrive folder
• A SharePoint document
• An accounting-data file
• A folder from a server
• Data belonging to a former employee

Confirm that the restored information opens correctly and that its permissions and dates are usable.

Annual recovery exercise

At least once a year, simulate a more serious outage. Assume a server, primary storage system or Microsoft 365 administrator account is unavailable.

Measure how long it takes to rebuild access and restore priority services. The exercise should expose unclear responsibilities, missing passwords and unrealistic recovery expectations.

Businesses that cannot tolerate several hours of downtime should test more frequently.

Define what must return first

Not every file has the same operational value.

An architectural practice may prioritise active project files. A brokerage may need client records, policy documents and email. A retailer may need point-of-sale data and supplier information.

Your recovery plan should identify:

• The most critical systems
• The order in which they must be restored
• The maximum acceptable data loss
• The maximum acceptable downtime
• Who can authorise a recovery
• Where passwords and encryption keys are stored
• How staff will work during the outage

A test should measure performance against these requirements.

Test Microsoft 365 as well

Many SMEs back up a local server but overlook Exchange Online, OneDrive, SharePoint and Teams.

Microsoft provides resilient infrastructure and native recovery tools, but businesses should understand their configuration and recovery limits. Independent Microsoft 365 backup can provide another recovery layer, particularly where deletion or compromise is discovered late.

Testing should include the restoration of individual cloud files, folders and emails.

Record and improve every test

Document what was restored, how long it took and which problems occurred. Assign corrective actions and repeat failed tests.

RandTech IT helps South African businesses implement monitored backups, test Microsoft 365 and local-data recovery, and create practical disaster-recovery plans.

If your business has never completed a recorded restore test, you do not yet know whether you have a working backup. Schedule the test before a real emergency sets the deadline for you.

Source: CISA’s ransomware and backup guidance