We have backups. But does recovery actually work?
In over 15 years of audits, the question 'do you have a backup system?' has almost always received the same answer: 'yes.' It’s the second question that separates truly secure companies from those operating on hope: when did you last test your data recovery procedure? That’s usually where the silence sets in.
The backup system that exists only in theory
This scenario is common. A former employee or an external contractor configured a backup process at some point. On an external hard drive, a NAS in a server room, or a forgotten cloud instance. Since then, management considers the issue resolved. Meanwhile, the storage space ran out, the automation broke after an update, or the copies are running empty on directories that no longer hold relevant information. Nobody audits the system because a backup is inherently a safety net you only check when it’s too late.
This is not an alarmist sales tactic, but the reality on the ground. An unverified backup represents a major operational risk. The difference between a functional system and a mere illusion always reveals itself at the most critical moment.
What a validated backup process actually means
Validation requires a precise action: a specialist accesses the archive and successfully recovers a file, a directory, or executes a full test restore, confirming the data is intact and usable. We do not rely on a process that theoretically runs, nor on a simple success notification. Data must be recovered, opened, and verified. This procedure must be scheduled and systematically documented.
During our audits, we look for two essential elements. The first is location: if the backup archive resides on the same physical server or network as the original data, a single technical incident compromises both. A cloud copy, completely isolated from the office network, resolves this vulnerability. In our pricing, this service starts at €30 per month for 500 GB, to provide an order of magnitude. The second element is information control: if the recovery procedure is known by only one person, the company does not have a safety plan, but a vulnerability.
Ransomware: when the contingency plan becomes priority zero
Ransomware gets written about a lot, but for a company it comes down to a single principle: on the day your data is encrypted, a validated backup makes the difference between a minor operational incident and a lost month of activity. Ransomware attacks actively search for backup archives too. This is why an external copy, completely inaccessible from the company’s main network, is critical.
Another frequently ignored detail is the recovery time objective (RTO). A full infrastructure restore does not happen instantly. If the process has never been tested, the company's downtime remains an unknown variable. Where procedures have been audited, the team follows a precise technical script. Otherwise, everything relies on improvisation.
Evaluating your current infrastructure today
Ask your team or IT partner the following three fundamental questions: When did the last data backup run and how is it confirmed? When was the last test restore performed? If the main server becomes unavailable tomorrow, where do we recover the information from, and what is the estimated time to resume operations? Documented answers to these questions guarantee business continuity.
If the answers involve uncertainty, the process needs to be reviewed. Our free audit analyzes these procedures, alongside access permissions and system updates. At the end, we provide a detailed technical report. No alarmist language, just a clear analysis and the necessary steps to secure your company.