Toolkit · Security · about 4 minutes
Backup & Recovery Check
Everyday loss, not adversaries: hardware failure, deletion, a failed migration, a flood. The two questions that matter most are whether you have ever restored, and whether every copy is in one place.
16 questions. Nothing is sent anywhere as you answer — the scoring runs in your browser, and we only receive anything if you ask for the written version at the end.
Coverage
What is actually being backed up.
Do you have a written list of every system holding business data, with its backup status?
Is there at least one copy held offsite or in a separate cloud account?
A backup on a NAS in the same building is not protected against fire, flood or theft.
Are cloud services — Microsoft 365, Google Workspace, your CRM — backed up independently of the vendor?
Are endpoints and laptops covered, or is data required to live on managed storage?
Testing
Whether the backups work.
Has a restore been performed and verified in the last 12 months?
An untested backup is a hypothesis. The failure is usually discovered at the worst possible moment.
Do you know how long a full restore actually takes, from measurement rather than estimate?
Do backup failures raise an alert that a named person acts on?
Is backup integrity verified automatically rather than assumed from a green tick?
Objectives
How much loss and downtime the business can absorb.
Has the business agreed how much data it can afford to lose, and how long it can be down?
Does the current backup schedule actually meet those targets?
Is retention long enough to recover from a problem discovered weeks later?
Do you know the cost of a day of downtime, so the spend can be judged against it?
Continuity
Running the business while systems are down.
Is there a documented recovery plan naming who does what, available offline?
Do you know the order systems must come back in, and what depends on what?
Has the plan been walked through with the people who would run it?
Do you have contact details for staff, customers and suppliers accessible without your systems?