You back up your business data. But can you actually restore it?

Backing up your business data is one of the most common pieces of cybersecurity advice. And perhaps you already do it. That's a good start, but there is another question worth asking:

If you lost access to your business data tomorrow, could you actually get it back?

For a small business, finding out that your backup is incomplete, outdated or impossible to restore after ransomware, a stolen laptop or a failed hard drive is far too late.

Key takeaways:

• Having a backup doesn't necessarily mean you'll be able to recover all your business data.
• Backups can be incomplete, outdated, corrupted or accessible to ransomware.
• You should know what is being backed up, where copies are stored and whether attackers could reach them.
• Testing a restore is one of the simplest ways to find out whether your backup actually works.
• Your recovery plan should also cover who knows how to restore your data and what you would need first after an incident.

Why having a backup isn't the same as being able to recover

You turn on automatic backups, connect a cloud service or occasionally copy important files to an external drive, and assume the job is done.

But several things can go wrong: a backup might have stopped running weeks ago without you noticing, important folders or devices may not be included, or you may lose access to a cloud account.

During a ransomware attack, backups connected to the same computer or network may also be encrypted or deleted.

How to check if your small business backups actually work

That's why the real goal isn't simply to have a backup. It is to be able to recover your business after something goes wrong.

Here are six questions that can help you find out whether you're prepared.

1. When did your last backup actually run?

If your backups are automated, when was the last time you checked them? Open your backup service and check the date and status of the most recent backup. Look for failed jobs, error messages, storage limits or devices that haven't backed up recently.

Also think about how much data you could afford to lose. If you back up once a week and something happens on Friday afternoon, you could potentially lose almost a week's worth of files.  For some businesses, losing even one day's invoices, customer records or project work could cause serious problems.

2. What business data are you actually backing up?

“Everything is in the cloud” isn't quite the same as knowing what is protected.

Make a quick list of the data your business depends on. Depending on what you do, that could include:

• Customer and supplier information
• Contracts and business documents
• Accounting and tax records
• Invoices and payment information
• Project files
• Photos, designs or other business assets
• Employee records
• Emails and contacts
• Website files or databases

Then check which of those things are actually included in your backup. Think beyond your own laptop, too. If employees use business devices or store important files locally, their data may need to be backed up as well.

And remember that syncing and backing up are not always the same thing. A cloud service may synchronize changes or deletions across your devices, so check what recovery and version-history options your service actually provides.

3. Where are your business backups stored?

Keeping a backup beside your main computer may not be enough. Theft, fire, flooding or hardware failure could leave you without both the original data and the copy you were relying on.

This is why businesses are often advised to keep more than one copy of important data in different places. You may hear this described as the 3-2-1 backup rule: keep three copies of your data, on two different types of storage, with one copy stored off-site.

4. Could ransomware reach your backups too?

Some ransomware attacks don't stop at encrypting the files on one computer. Attackers may also try to reach connected drives, network storage, cloud accounts or backup systems.

Check how easy it would be for someone who compromised your business systems to reach your backups too. Is a backup drive constantly connected? Can someone with an administrator account delete your backups? Does your backup service use a password you've used elsewhere? Is multi-factor authentication enabled where available?

Ideally, at least one backup should be protected in a way that prevents a compromise of your everyday systems from taking your recovery copy with it.

5. Have you ever tried restoring a file from your backup?

You don't have to wait for a disaster to find out whether your backup works.

Choose a non-critical file and try restoring it. Then open the recovered file and make sure it works as expected. A simple restore test can uncover problems you wouldn't otherwise notice, such as missing folders, outdated versions, corrupted files, forgotten passwords or a recovery process that's much more complicated than you expected.

If you've never restored anything from your backup, you don't really know yet whether you can

6. Who knows how to restore your business data?

Imagine your main computer dies tomorrow and you need to continue working from another device. Where would you retrieve your files? Which account would you need? Do you know the password? Would you need a recovery key or multi-factor authentication?

And importantly, does anyone else know what to do if you're unavailable?

If someone else manages your IT or backups, make sure you know how to contact them and what they would need from you.

If you have employees, decide who is responsible for recovery and document the basic process. Your backup plan shouldn't depend entirely on one person remembering how everything works.

What should you restore first after a cyberattack or data loss?

Even if everything is backed up, you probably don't need to restore everything at once.

Think about what your business would need to keep operating in the first few hours or days after an incident. That might be customer information and current projects, accounting records, booking information, email or a critical business database.

Knowing your priorities in advance helps you decide which data needs the strongest backup protection and what should be restored first. It also gives you a much better idea of how quickly you could realistically get your business running again.

How to protect your small business from ransomware beyond backups

A good backup can help your business recover from ransomware, hardware failure, accidental deletion and other forms of data loss. But it shouldn't be your only line of defense. Preventing attackers from reaching your devices and accounts in the first place is just as important.

That means keeping devices and software updated, using strong and unique passwords, enabling multi-factor authentication, protecting business email, training employees to recognize scams and phishing attempts, and using security software across the devices your business relies on.

Bitdefender Ultimate Small Business Security is designed for small businesses that may not have dedicated IT staff. It helps protect your devices, accounts and employees against malware, ransomware, phishing, scams and other online threats, while giving you visibility over your business security from one dashboard.

Try Bitdefender Ultimate Small Business Security free for 30 days. No credit card required.

You may also want to read:

• What to do after receiving a ransomware note
• Your business uses MFA. But are you using it on the right accounts?
• The first 5 cybersecurity measures every small business should take
• Can your small business be hacked without you knowing?

FAQs

How often should a small business back up its data?

It depends on how frequently your business data changes and how much information you could afford to lose. A business that processes transactions or updates customer records throughout the day may need more frequent backups than one whose important files change only occasionally. Automatic backups can help, but you should also regularly check that they are completing successfully.

How often should I test my business backups?

There isn't one schedule that fits every business, but backups should be tested regularly and after significant changes to your systems or backup setup. Even restoring a sample file periodically can help confirm that your data is available and the recovery process works.

Can ransomware infect backups?

Yes. Ransomware may be able to encrypt or delete backups that are connected to an infected device or accessible through compromised accounts or networks. Keeping separate or isolated backup copies and protecting backup accounts can reduce this risk.

Is cloud storage the same as a backup?

Not necessarily. Some cloud services primarily synchronize files between devices. If a file is changed, encrypted or deleted, that change may be synchronized as well. Some services provide version history and recovery features, but you should check exactly what your service protects and for how long.

How do I know if my backup is working?

The best way to check is to review when your last backup completed successfully and try restoring a non-critical file. Make sure the restored file opens correctly and check for errors, missing folders or devices that aren't being backed up.