A green status light does not answer the owner’s question

Your provider reports that backups complete successfully. That is useful, but the business question is more specific: after a failure tomorrow morning, could you prepare orders, retrieve files and issue invoices? A file on a storage device proves neither that it opens nor that the required access and software are available.

CNIL recommends checking backup integrity and restoration. The method below turns that principle into a small, observable exercise based on the actual work your business performs.

Start with one essential service

Choose one service, such as preparing deliveries. List its dependencies: orders, addresses, stock, software, authorised accounts and printable documents. Ask the person performing the task to describe the minimum they need rather than assuming the shared folder contains everything.

Set two separate objectives: how many hours of data could you accept losing, and how long could the service remain unavailable? A nightly backup alone cannot guarantee recovery of orders entered the following morning. Your objectives must match the protection mechanisms you have actually tested.

Prepare an exercise that produces evidence

With your IT lead, restore a dataset into an environment isolated from production. Use restricted access and retain normal safeguards. Verify a complete business action: open a case, read its attachments and produce a checking document without sending it to a customer.

Record the start time, when data becomes accessible and when the business task works. Document the selected backup, checks performed and obstacles. Downloading may be quick while a missing account, encryption key or software version prevents the next step.

Fictional example: two hours to restore, six hours offline

In a fictional SME, order files are recovered in two hours. The team then spends another four hours finding the correct software and restoring permissions. Service therefore resumes after six hours. A two-hour recovery promise would be unsupported even though the technical file restoration met that target.

The latest copy is from 11 pm; the failure occurs at 11 am. Those twelve hours form a potential data-loss window, refined according to actual entries and any other available logs. The chosen action is to document access and test more frequent protection for orders.

What to organise next week

CNIL recommends an isolated offline copy and a copy at a separate site, among other safeguards. Ask your provider how these protections operate under your contract, then organise the exercise together.

  • Choose a critical service and name a business owner and a technical contact.
  • Write data-loss and recovery-time objectives in language everyone understands.
  • Check that an incident affecting the main account cannot also erase every backup copy.
  • Perform an isolated restoration, time the complete task and retain the exercise report.
  • Fix the main obstacle observed and schedule another targeted test.

Plan how work continues during the outage

A temporary procedure should define who decides, how new requests are recorded and how they will be entered into the restored system. CNIL distinguishes this continuity from restarting the system itself. A successful single-file test does not prove whole-business recovery or the absence of ransomware: adapt the scenario with your provider and update the plan whenever your tools change.