A successful report is only the beginning
A completed backup job confirms that its configured procedure finished. It does not establish that every required folder is included, the database is consistent or the encryption key is available. Test the ability to resume a working process, not the icon in the backup application.
List everything required to restart: data, application, settings, licences, accounts and instructions. An accounting application may need more than a copied folder. Consult its documentation for the correct way to create a consistent backup.
Separate data loss from recovery time
Suppose an organisation can re-enter the last hour's documents but must resume operations within four hours. This is an illustrative example, not a standard. The first limit determines acceptable data age; the second covers the entire recovery, including equipment availability and user verification.
A backup schedule alone cannot guarantee those objectives. Downloading a large archive over a slow connection may take longer than starting the application. Time the complete process and record the stages where delays occur.
Run a separate restoration test
Choose a backup and prepare an isolated destination. Do not restore over the live database simply to test it. Restrict the test system's network connections so it cannot send real emails, documents or jobs to production services.
Open files from several dates, check permissions and ask the application owner to perform a normal task. Record the backup date, recovery duration, result and limitations. Test an older version too: the newest backup may already include an unnoticed error.
Protect the backup itself
A backup writable by the same compromised account can be destroyed with the original. Consider isolated or immutable storage where supported, separate permissions and protected encryption keys. CISA recommends offline backups and regular restoration testing.
Assign responsibility for failed jobs and repeat testing after application, equipment or storage changes. Folder synchronisation can propagate deletion across devices. It contributes to protection only when version history, retention and recovery procedures are understood and tested.
What to check
- The backup includes everything required to restart
- The responsible person can access keys and credentials
- Testing is isolated from production
- Recovery time and results are recorded
Sources
Check specifications and terms for the exact model and product version.