You've probably seen the green checkmark, "Backup completed successfully." You feel good. Let’s be honest, maybe even a little smug, and you move on with your day. If you have IT support, you might get a routine confirmation email letting you know it’s been completed.
Then one morning a laptop dies, someone deletes the wrong folder, or ransomware locks your files.
If you have ongoing support, you probably panic-call your IT person, and they handle it.
If you don’t, you likely go to restore, and the backup is six months old, missing the one folder you need, or won't open at all.
That's what I call a zombie backup because it looks alive on the dashboard, but it's dead where it counts. Zombies want brains, and you just want your files back. I mean, after all, it is YOUR business, right?!
Last week, we talked about ghost policies, and tested backups are one of the safeguards insurers really care about. A policy won't help much if your recovery plan doesn't work. So this week, let's make sure yours has a pulse. See what I did there?
Why backups turn into zombies
Here are the most common ways it happens:
Nobody ever tested a restore: A backup you've never restored from is hope, not a plan, and we all know, “Hope is not a strategy.” The green checkmark only says the job ran. It doesn't say your files will come back whole.
It's not backing up everything that matters: You create new folders, new apps, got a new laptop that was never added, the shared drive someone set up last year, and the list goes on. Many people also assume cloud services like Microsoft 365 or Google Workspace keep a full backup for them. That's not always the case, so it's worth asking the question.
It quietly stopped working: We know passwords change more than we’d like to admit, storage fills up faster than we’d like, and devices get replaced more often than we want to shoulder the expense. Alerts go to an inbox nobody checks, or to a new hire who was never added, and weeks later you're relying on a backup that unexpectedly stopped in the spring.
It's sitting right next to the problem: If your backup is plugged into the same computer or network, ransomware can lock it right along with everything else, and that’s a problem you really don’t want to discover after the worst happens.
Nobody knows how long recovery takes: Even a perfect backup can take hours or days to restore. Remember last week's blog about downtime coverage? Restore time is where that gets real and measurable.
A simple rule of thumb: 3-2-1
Keep three copies of your data, on two different types of storage, with one copy offsite or offline. It's not fancy, and it doesn’t have to be. The most important thing? That it works. It's also a great thing to bring up with your IT person. I’m always here for questions as well. You can email me here.
Give your backup a pulse check
You don't have to be "techy" for this. Set aside about 15 minutes:
Make a list of what you can't live without. Accounting files, customer records, email, shared drives, marketing lists, SOPs, and more. Using new apps or AI tools that hold business data? Add those, too. You can’t have too many, and if you think you do, your IT person can help you pare them down.
Check the date of your last successful backup. If you don't know where to look, that's useful information, too.
Restore one real file. Pick a spreadsheet or document, restore it to a different spot, and open it. Does it look right? Does it function as intended?
Ask how long a full recovery would take. If your computers were gone today, how long until you were back to work? Write the answer down and be realistic.
Put it on the calendar. Test every few months again, or sooner after big changes like new computers, new software, or new employees.
If you have an IT person, ask when they last did a test restore. If you don't, I'm happy to help. I do this all the time!
Not sure where the rest of your setup stands? This free, self-guided IT Gap Check shows where your policies and systems are strong and where they need work. Looking for more best practices? Check out CISA’s backup guidance.
The bottom line
A backup you've never tested is truly just a guess. Spend 15 minutes proving it works now, so you're not hunting through dashboards on your worst day.
Have a question or want a hand getting started? Get in touch here, and I'll be happy to give you the best guidance for your unique situation.
Missed the first three? Read The Scariest Thing in Your Business is a Reused Password, What Are Passkeys? All Treat, No Trick!, and Is Your Cyber Insurance a Ghost Policy?
About the author: Kevin Dutkiewicz is the founder of TechBrews, providing practical IT and cybersecurity guidance to small businesses in Stow and across Northeast Ohio.