Backups You Have Never Tested Are Not Backups: A Quarterly Restore-Test Runbook

The moment that ends companies is predictable: ransomware hits, the owner says we have backups, and then the backups do not restore. They were corrupted, incomplete, or quietly failing for months, and nobody checked. A backup you have never tested is only a hope. Testing turns it into a plan.

Confirm the backups are actually running and protected

Start each quarter by verifying that every important system is being backed up on schedule, and that at least one copy is immutable, meaning an attacker cannot encrypt or delete it. Insurers increasingly require this, and it is the difference between recovering and paying a ransom.

Do a real restore, not just a green checkmark

A successful backup report is not proof of anything. Once a quarter, actually restore a set of files, and ideally a full system, to a safe location and confirm the data opens and works. This is the only way to know your recovery time is measured in hours, not days, and that nothing critical was missed.

Write down what you learn

Record how long the restore took, what worked, and what did not, then fix the gaps before the next test. Over a few cycles this turns into a documented recovery plan, which is exactly what you want in hand during a real incident and exactly what auditors and insurers ask to see.

The best time to find out your backups work is on a quiet Tuesday, not during a ransomware attack.