Microtechie
Home/Resources/Testing Business Backups

Backup guide

Testing Business Backups: How to Prove You Can Actually Restore

Backup7 min readUpdated October 14, 2026

A backup job that reports success every night proves only that data was copied somewhere. It doesn't prove that the data is complete, readable or recoverable within a time the business can tolerate. The only evidence of that is a restore test, carried out on a schedule and written down.

Applies toBusinesses backing up servers, workstations, network storage and cloud services such as Microsoft 365 and Google Workspace.

Define what “recovered” means

Before testing, agree two numbers for each important system:

  • Recovery point objective (RPO): how much recent work the business can afford to lose, for example one day.
  • Recovery time objective (RTO): how long the business can operate without the system, for example four hours.

Tests are then measured against those targets rather than simply passed or failed.

Step-by-step

  1. Confirm what's actually included

    Compare the backup selection with the systems the business depends on. New file shares, databases, line-of-business applications and recently added laptops are frequently missing.

  2. Run a file-level restore

    Restore a selection of files and folders, including recently changed files, to an alternate location. Open them to confirm they are complete and readable, and check permissions.

  3. Restore a mailbox or cloud data

    Microsoft 365 retains deleted items only for limited periods. If you use a third-party backup for Microsoft 365 or Google Workspace, restore a mailbox folder and a OneDrive or SharePoint folder to prove it works.

  4. Test a full system recovery

    At least annually, recover a complete server or critical system into an isolated environment and confirm the application starts and data is current. Time the process from start to usable system and compare it with your RTO.

  5. Verify the offsite and immutable copy

    Confirm that at least one copy is held offsite or in the cloud and cannot be altered or deleted by an attacker with administrator access, such as an immutable or offline copy. Ransomware targets backups deliberately.

  6. Record the results

    Log the date, what was restored, how long it took, any problems and how they were fixed. That record is useful evidence for insurers and auditors.

Frequently asked questions

How often should we test restores?
File restores monthly or quarterly, and a full system recovery at least once a year or after significant changes.
Isn't Microsoft 365 already backed up by Microsoft?
Microsoft keeps the service running and offers limited retention, but it isn't a substitute for an independent backup with longer retention.
What is the 3-2-1 rule?
Three copies of data, on two different types of storage, with one copy offsite. Many organizations now add an immutable or offline copy as well.
Before you change anythingConfirm you have a current backup and, where configuration changes affect several users, schedule them outside working hours. If you'd prefer us to handle it, get in touch.