A Backup Is Only Useful If You Can Restore It

It is 8:15 on a busy morning. The shop's computer will not start, and the file with yesterday's orders is nowhere in sight. Someone remembers that backups run overnight. That is reassuring, right up until nobody knows whether the latest copy includes the order file or how to get it back.

A backup plan should answer two plain questions: what information matters enough to save, and can the team restore it when the usual computer or account is unavailable? A green check mark from a backup app helps, but it does not answer the second question. A small, regular restore test can.

Start with the records that keep work moving

Write down the business information that would be painful to recreate or would stop tomorrow's work. For a local shop, that might include sales exports, invoices, supplier contacts, current price or inventory files, appointment records, and documents needed to close the books. A service business may care more about its schedule, customer contact records, estimates, and job notes.

Do not assume every item lives in one place. A point-of-sale system may keep transactions in its own account, while a spreadsheet sits on a manager's laptop and invoices arrive by email. Note the system or device that holds each important record, who can access it, and how the business can request an export or recovery. You do not need an elaborate inventory. One page that the owner and backup person can understand is a good start.

Then ask how much recent work the business could afford to lose. If a day's orders would be hard to reconstruct, a once-a-week copy is probably too slow for that record. If an old marketing image can be downloaded again, it may not need the same attention. Choose a backup schedule around the cost of losing the information, not around a setting that happened to be selected during setup.

Know what a backup means for each tool

Many business tools store data online, which is useful when a laptop breaks. Still, online storage is not automatically a complete recovery plan. A deleted file may disappear from a synced folder on other devices too. A service may have its own recovery window or export option, but the details vary. Check the current plan and settings for each service instead of assuming they all work alike.

For important records, keep a copy that is separate from the everyday device or account. The right arrangement depends on the tool and the business, so ask the provider or IT support how to protect the backup and how long it remains available. A drive that stays plugged into the same computer all day may be convenient, but it can share some of that computer's risks. CISA's small-business backup guidance recommends backing up business data and testing restores.

Protect the backup itself. Limit access to people who need it, use unique passwords, and turn on multifactor authentication where the service offers it. Multifactor authentication asks for another proof of identity, such as a code or approval on a device, in addition to a password. It can make an account harder to take over if a password is exposed. CISA explains the options in its multifactor authentication guidance.

Practice getting one file back

A restore test does not need to be a dramatic full-system recovery. Pick a low-risk file, such as a sample document or an older report, and restore it to a separate folder or test device. Check that it opens and contains what you expect. If your backup provider has a restore preview, use it to learn the steps, but confirm that the business can retrieve a usable copy.

Write down the steps while they are fresh: which account to sign into, where the restore option is, who is allowed to approve it, and whom to contact if it fails. Keep those directions somewhere the team can reach if the main computer is down. Do not put passwords in an unprotected note beside them. Use your normal approved password manager or recovery process.

Set a recurring reminder to test a small restore and review the backup list. Monthly or quarterly may be reasonable starting points for some small teams, but the right interval depends on how often important records change and how much downtime the business can accept. Also test after a major change, such as moving to new accounting software or changing the way sales are exported.

Make recovery a team task, not a mystery

Choose a primary person and a backup person who know where the records and instructions are. A shop owner may be the first contact, but the plan should not depend on that one person being available. The second person does not need to be a technical expert. They need to know whom to call and how to avoid making the problem worse.

If a device or account may have been compromised, do not rush to reconnect it or overwrite backups. Pause, contact the service provider or trusted IT support, and follow the business's incident response steps. Preserve useful details about what happened and when. A routine lost file and a suspected cyber incident are different situations; a provider can help determine the right recovery path.

Try a quick tabletop rehearsal too. Ask: 'The checkout computer is unavailable, and we need yesterday's sales total. What do we do first?' Walk through the answer without touching live data. If the team cannot find the export or identify who can access it, that is a useful gap to fix on a quiet afternoon, not during the morning rush.

A short plan beats a hopeful setting

Keep the finished plan brief: important records and where they live, how often each one is copied, where the separate copy is kept, who can restore it, and when the team last tested the process. Put a review date on the calendar. After a test, record what worked and fix one clear problem at a time.

Backups cannot prevent every interruption, and a test does not guarantee that every future recovery will be easy. It does replace one guess with useful knowledge: the team has seen the restore steps, checked a real file, and knows where to turn if something goes wrong. That is a much better place to start than searching for an old password while the shop waits.