The backup dashboard is green. That is reassuring, but the managing director has a different question: if the main system stopped working this morning, when could the business take orders again?
A backup job and a business recovery plan answer different questions. The first records that a copying process completed. The second needs to show which information can be recovered, who can do it and how the business will operate while recovery takes place.
Start with one important business activity
Choose a practical scenario such as recovering an accidentally deleted customer folder or restoring the information needed to process an order. Ask the people doing that work what they would need first. Include the application, permissions and related records, not just the most obvious spreadsheet.
Agree two business expectations: how much recent work you could afford to lose, and how long the activity could reasonably be unavailable. Your IT team can then explain whether the current arrangements meet those expectations and what would need to change.
Run a controlled restore test
Recover a suitable sample into a safe location that will not overwrite live work. Confirm that the files open, the content is useful and the intended person can access it. For an application, test the dependencies needed for meaningful use rather than stopping when a server starts.
The NCSC recommends regularly checking that backups work and that you know how to restore them. It also advises protecting backup copies against the same attack or failure that affects live systems.
- Record the recovery point used and why it was selected.
- Measure the time from requesting recovery to confirming usable information.
- Check who can access backup administration and recovery credentials.
- Record gaps and assign the corrective work to a named person.
Ask what happens when the usual engineer is away
Recovery instructions should be understandable to another authorised person. That does not mean exposing powerful credentials in a shared document. It means documenting how the approved people obtain access, which supplier to call and where the recovery procedure is held.
Consider a scenario in which your normal email, office connection or password manager is unavailable. The people leading the response still need access to essential contact details and instructions. Agree a secure alternative with your provider.
Include cloud data in the conversation
Ask who is responsible for recovering information held in Microsoft 365 and other online services. Understand the recovery features you have, their limits and whether a separate backup service forms part of your agreement. Avoid treating the word “cloud” as a complete recovery plan.
The right design depends on the data, business requirements and service terms. Get those responsibilities written down so the finance team, management and IT provider share the same understanding.
Make the result useful to management
A short report should state what was recovered, how long it took, what did not work and which changes are required. Repeat the exercise after significant system changes and at an interval agreed around business risk.
39Support can help review your backup responsibilities and arrange a practical recovery test. Bring your current backup report and one business activity you would need to restore first.