The backup you have never tested is not a backup

Published 2026-08-25 by Woodruff Training

Ask a small business owner whether they back up their data and almost everyone says yes. Ask when somebody last restored a file from that backup and the answer is usually a pause. That pause is the problem, because a backup is not a thing you own. It is a thing that either works on the worst morning of your year or it does not, and the only way to know which is to try it while nothing is wrong.

Where backups quietly fail

The failures we see are rarely dramatic. They are small and boring, and they sit there for months.

• It covers the wrong things. The laptops are backed up but the accounting package is not, or the shared drive is included and the one folder the business runs on lives on somebody's desktop.
• It stopped, and the warning email went to a mailbox nobody reads. Backups fail quietly by design. A disk fills up, a password changes, and the last good copy is from March.
• The only spare copy is plugged into the machine it is protecting. That is fine against a hard drive dying. It is no help against a fire, a burglary, or ransomware, which now goes looking for connected backup drives on purpose.
• Someone assumed Microsoft 365 or Google Workspace was doing it. These sync your files, which is not the same thing. Delete a file in a synced folder and it disappears everywhere. Both have a limited recycle bin window and it is shorter than most people imagine.

Three copies, two places, one out of reach

The old rule still holds up. Keep three copies of anything you would hate to lose, on at least two different types of storage, with one of them off-site or offline.

For a small business that usually means the working copy on your systems, a cloud backup service running daily, and either a second cloud copy or a drive that gets swapped and taken home. The important word is offline. One copy needs to sit somewhere an everyday login cannot reach and cannot delete, because if a criminal gets into your email they will try the backup next.

The hour that proves it

Put this in the diary and actually do it.

• Pick a real file from a month ago and restore it yourself. Not a test document you made this morning. Time how long it takes.
• Check the last successful backup date on every system, not just the obvious one. Write the dates down.
• Ask who gets the failure alerts, and check that person still works here and still reads them.
• Try restoring something bigger, or ask your IT provider to walk you through how a full recovery would go and how long it would take.
• Confirm at least one copy cannot be deleted by someone logged in as you.

That last exercise tends to be the useful one, because it turns a vague comfort into a number. If getting back to work would take four days, you now know something worth knowing, and you can decide whether four days is acceptable or whether it is worth paying to make it one.

The real question was never whether you have a backup. It is how long you would be out of action, and who is doing the restoring while the phone rings. A tabletop exercise is a good way to find out before it matters, or get in touch and we can talk it through.