Are your backups actually working? A 5-point test for small businesses

A backup you have never restored is only a guess. A green dashboard every morning tells you the backup job ran. It does not tell you the data is complete, uncorrupted, and something you could bring back before the business grinds to a stop. The only real proof a backup works is a restore you have tested. Ransomware crews understand this better than most owners do, and one of their first moves after they get in is to hunt down your backups and delete them.

Why "we have backups" and "we can recover" are different things

Owners find the gap at the worst possible moment. The backup had been running for months, but it was only copying one folder. It captured the file server and quietly skipped Microsoft 365. The restore worked, but it took three days when the business could survive one. Any of these turns a backup into a false sense of security, and you do not learn which one applies to you until you try to recover.

The stakes climb every year because attackers plan around backups now. They get in, study the network, locate the backup system, check what it can reach, and wipe or encrypt it before they trigger the visible attack. If your backups live on the same network with the same logins as everything else, the attacker reaches them too. Our guide on how Collin County businesses actually get hit walks through those entry points in plain terms.

The 5-point test

Run these five checks against your current setup. If you cannot answer all five with confidence, you have a backup, not a recovery plan.

• Restore a real file. Pick a document from last week and bring it back from the backup. A green "job succeeded" status only confirms the copy ran. Opening the restored file is what confirms the data survived the trip.
• Time the restore. Note how long it takes to recover a full critical system, start to finish. That number is your real recovery time. Compare it against how long the business can function while that system is down, and close the gap if the numbers do not line up.
• Check what is actually covered. List every place your data lives: servers, laptops, and cloud services like Microsoft 365, including email, OneDrive, SharePoint, and Teams. Microsoft keeps the platform running, but recovering your content is on you, and SaaS data is the most common blind spot we find.
• Confirm one copy is out of reach. Follow the 3-2-1 rule: three copies of your data, on two types of media, with one copy offline or immutable. That untouchable copy is what stops ransomware from deleting your backups along with everything else.
• Run a full recovery drill. Rebuild a critical system into a test environment and confirm the data opens and the application runs. A drill surfaces the missing password, the skipped database, and the driver nobody documented, while you still have time to fix them.

How often to test

Restore a sample file every month so you catch silent failures early. Run a full recovery drill of your most important system at least twice a year, and again after any big change: a new server, a Microsoft 365 migration, or a switch in backup software. Backups drift out of sync with the business quietly, and a schedule is what keeps a stale configuration from becoming the reason a recovery fails. Backups are one control among several, and our small-business cybersecurity checklist shows where they sit alongside MFA, patching, and training.

Who owns the test

A backup nobody is responsible for is a backup nobody is testing. Someone has to own the schedule, run the drills, read the logs, and fix what breaks. For most small businesses that person already wears five other hats, so the testing slips until an outage forces the issue. A managed IT partner makes recovery a monitored, documented routine. If you are weighing that against paying by the hour when something breaks, our guide on managed IT versus break-fix lays out the tradeoffs.

Frequently asked questions

How do I know if my backups work?

Restore something. Pick a real document from last week, bring it back from the backup, and open it. A green dashboard confirms the backup job ran; opening a restored file confirms the data survived. Until you have done a test restore, your backup is a guess.

How often should a small business test its backups?

Restore a sample file every month to catch silent failures before they matter. Run a full recovery drill on your most important system at least twice a year, and again after any big change such as a new server, a Microsoft 365 migration, or new backup software. Backups drift out of sync with the business, and a schedule catches the drift before an outage does.

What is the 3-2-1 backup rule?

Keep three copies of your data, on two types of media, with one copy offline or immutable. The untouchable copy is the one that matters most against ransomware, because attackers hunt for your backups and delete them before launching the visible attack. If every copy sits on the same network with the same logins, one stolen password can reach them all.

Does Microsoft 365 back up my email and files?

Microsoft keeps the platform running, but recovering your content is on you. Email, OneDrive, SharePoint, and Teams data all need their own backup, and unprotected Microsoft 365 data is the most common blind spot we find in small businesses. Add it to your coverage list next to servers and laptops.

Can ransomware delete my backups?

Yes, and modern crews plan for it. After getting in, they study the network, locate the backup system, and wipe or encrypt it before triggering the visible attack. An offline or immutable copy that no network login can reach is what breaks that play.

What does it cost to have a provider manage backups?

37 Forge works on flat per-device pricing. Essentials is $37 per device per month plus $49 per month for network monitoring, with support billed hourly: $60 remote, $150 for the first on-site hour, then $100 per hour. Secure, the most popular plan, is $135 per device per month and includes Microsoft 365 Business Standard. We are based in McKinney and serve Collin County, with on-site help in under an hour.