Almost every small business I visit tells me they have backups. Far fewer can tell me the last time anyone restored one. Those are not the same thing, and the gap between them is where businesses get hurt.
A backup nobody has tested is a hope
Backup software reports success. That report means it finished running. It does not mean the data is complete, that it is readable, or that anyone knows how to get it back.
The failures I actually find, in roughly the order I find them:
It stopped months ago. A password changed, a disk filled, a service was updated. The job failed quietly, the alert went to somebody who left, and nobody noticed because nothing needed restoring.
It is backing up the wrong thing. Documents are covered. The accounts database, sitting in a folder nobody thought of as data, is not.
It is on the same machine. An external drive left permanently plugged in is not an off site backup. Ransomware encrypts it along with everything else, and a fire or a theft takes both.
Nobody knows how to restore it. The one person who understood it has left. The software is still running. The knowledge is not.
It works, but slowly. The restore genuinely functions and takes eleven hours. Nobody had ever asked, so nobody had planned for a day and a half offline.
The two numbers nobody has decided
Before you can say whether a backup is adequate, you need two answers, and most businesses have never been asked for them.
How much work can you afford to lose? If backups run nightly at 2am and the server dies at 4pm, you have lost a day. For some businesses that is irritating. For others it is unrecoverable.
How long can you be down? An hour, a day, a week. This drives what the recovery has to look like, and it is a business decision rather than a technical one.
Answer those two and the right backup arrangement becomes obvious. Skip them and you are buying storage and hoping.
What good looks like
The old rule still holds. Three copies of your data, on two different kinds of storage, with one of them off site. Cloud counts as off site, provided it is not simply syncing your mistakes.
Sync is not backup, and this catches people out. If OneDrive or Dropbox is your only protection, then deleting a file or encrypting it deletes and encrypts the copy too. You need versioning and a retention window, so you can go back to before the bad thing happened.
And it needs testing. Not a report saying success. An actual file, pulled back, opened, and confirmed to be the thing you expected.
Do this today, it takes ten minutes
Pick one file that matters. Something from a fortnight ago, ideally one somebody would notice missing.
Restore it. Not check that it appears in a list. Restore it to a different location and open it.
Time how long the whole thing took, and notice whether you had to ask anyone how. If you could not do it without help, that is the finding, and it is worth knowing now rather than on the morning it matters.
If that did not go well
An annual security and backup review is £350. It covers what is actually backed up, what is not, whether a restore works, how long it takes, and who can do it. You get a written summary you can act on, whether or not I am the one who acts on it.
Tell me what happened when you tried the ten minute test, or read more about IT support in Cambridge.