The backup you have never restored from is not a backup

Every practice we assess has backup of some kind. Far fewer have ever restored from it. That distinction stays theoretical right up until the morning it becomes the only thing that matters, and by then there is nothing you can do about it.

A successful job is not a successful restore

Backup software reports on whether it completed its own task. That is a narrower claim than it sounds. A job can finish cleanly having quietly skipped a database that was locked, or having backed up a folder that stopped being the live data location eight months ago when someone migrated it.

We have found backups running faithfully every night against a path that no longer contained anything. The dashboard was green for over a year. Nobody had done anything wrong; nobody had ever had a reason to look.

The only test that means anything is a restore. Not a verification pass, not a checksum, an actual restore of actual files to somewhere you can open them. If nobody has done that in the last quarter, you do not currently know whether your backup works. You are hoping, and you are recording the hope in a spreadsheet.

Ransomware hunts backups first

This is the part that catches people who otherwise take backup seriously.

Modern ransomware does not encrypt your files and leave. It spends time on the network first, and one of its priorities is your backups, because the operators know perfectly well that a practice which can restore is a practice which does not pay. So the tooling looks for backup software, backup shares, and cloud storage that a compromised administrator account can reach.

Anything your credentials can delete, their credentials can delete once they have yours. A backup drive plugged into the server is visible to the server. A network share the backup service can write to is a share the attacker can encrypt. Cloud storage with a saved password in the backup application is cloud storage they now have a password for.

The countermeasure is immutability. Storage that will not permit a copy to be altered or deleted within its retention window, no matter whose credentials arrive or what they claim to be. Not read-only by policy, which can be turned off, but genuinely unable to accept the instruction. That property is what turns an attack from an extinction event into an expensive Tuesday.

Microsoft does not back up your Microsoft 365 data

This one surprises people every single time, so it is worth stating plainly.

Microsoft guarantees the availability of the service. It does not guarantee the recoverability of your content. If a mailbox is deleted, or a staff member empties a SharePoint library, or an attacker with a valid login destroys things deliberately, Microsoft’s obligation is to keep the platform running. Retention policies and recycle bins buy you a limited window measured in days, and they can be shortened or emptied by anyone with sufficient privileges, which by that point may be the attacker.

If your email, files and Teams history matter, they need backing up like anything else. Most practices assume this is included. It is not.

Two numbers you should be able to say out loud

Every recovery conversation reduces to two figures, and knowing them changes the conversation from anxious to practical.

• Recovery point objective: how much data you can afford to lose, measured in time. Backups run nightly means up to a day of charting and images gone. If that is unacceptable, backups need to run more often. That is a business decision with a cost attached, not a technical detail.
• Recovery time objective: how long you can be down. Restoring an entire imaging server across a normal internet connection can take considerably longer than people expect. If the answer is longer than you can tolerate, the design needs a local copy for speed as well as an offsite one for safety.

If nobody can give you both numbers, they have not been measured, and an unmeasured recovery time is always discovered at the worst moment.

What good looks like

A recovery plan we would be comfortable signing our name to has four properties:

• Data goes offsite, encrypted, without a human remembering to do anything.
• At least one copy is immutable for its whole retention window.
• Restores are tested on a schedule and the results are written down, including how long they took.
• Coverage is explicit about the systems that actually matter, which in a practice means practice management, imaging, and Microsoft 365, named individually rather than assumed.

None of that is exotic and none of it is expensive relative to what it protects. It is simply the difference between having backups and being able to recover, and those two phrases describe very different Tuesday mornings.