Test a restore now, and again on a schedule
- Pick one essential system this week
- Have a second person restore it from backup
- Fix the gaps and book the next test
Backup & recovery
Prove your backup works before the day you need it
A restore test that a small or medium nonprofit or municipality can run this month, based on the Canadian Centre for Cyber Security's baseline controls for organizations with fewer than 500 employees.
The gap
A backup that only one person can restore is not a recovery plan.
Backups fail quietly: an expired password, a missing step, a copy that never finished. Without a test, you find out on the worst possible day.
What good looks like
| Instead of | Do this |
|---|---|
| Assuming last night's backup ran | Restore one real file and open it |
| One person who knows the steps | Written steps a second person can follow |
| Every copy connected and online | Weekly copies kept offline |
| Anyone can reach the backup files | Encrypted, with access limited to the people who restore |
Why it matters
The Cyber Centre's baseline controls aim to give small and medium organizations 80% of the benefit for 20% of the effort, and backing up and encrypting data (BC.7) is one of its 13 controls.
The Cyber Centre says backups help an organization recover from ransomware, equipment failure, theft or a natural disaster.
Restore test checklist
- The system and the person who will restore it are named
- Restore steps are written and stored where a second person can reach them
- The test restore went to a safe location, not over live data
- The restored files opened and were complete
- Weekly backups have an offline copy
- The next test date is in the calendar
Run a restore test, one system at a time
- Choose one essential system. The donor database, shared drive or finance files: whatever you could not operate without for a week.
- Write the restore steps. Plain language, written for someone who has never done it: which logins are needed and where each one is kept, but never the passwords themselves.
- Hand them to a second person. They restore one folder to a safe test location, never over the live copy.
- Fix what broke and book the next test. Note how long it took and which step failed. Repeat on a regular schedule.
Sources
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security. Read on .