"We have backup" is one of the most dangerous phrases in small-business IT. Most of the time it means there's something that looks like a backup — an external hard drive, a folder on OneDrive, maybe even a NAS bought 3 years ago. But nobody has checked whether it actually works.
Go through these 12 questions honestly. If you don't know the answer to some of them, that's where the vulnerability is. At the end, a simple score shows you where you stand.
Category 1: Backup existence and coverage (1–4)
The right answer: a specific list of folders, databases and applications — not "I think everything".
A typical wrong answer: "the backup runs automatically on the server", without knowing whether it includes the client database or the accounting.
Why it matters: if you don't know what's in the backup, you don't know what you can restore.
Manual backup = backup that doesn't happen. People forget, get busy, go on holiday.
The right answer: automatic, scheduled backup, with a notification if it fails.
Warning sign: "someone on the team starts it on Friday evening".
The 3-2-1 rule: 3 copies, 2 media, 1 offsite.
A single copy = a single point of failure. The hard drive dies, the laptop is stolen, the server burns.
The right answer: local NAS + cloud, or server + NAS + cloud.
The NAS and the server in the same office = destroyed by the same fire or taken in the same burglary.
Offsite doesn't have to mean another city — encrypted cloud storage is enough.
Wrong answer: "we have a backup on a hard drive in the cupboard" (same office).
Category 2: Backup security (5–7)
Encryption in transit (HTTPS) isn't enough — the provider can see your data.
End-to-end encryption: data is encrypted on your computer before it leaves for the cloud.
Why it matters for the GDPR: unencrypted data at the provider = a potential breach if the provider is attacked.
A backup reachable from the network you work on = encrypted by ransomware along with the rest of the data.
The right answer: immutable snapshots (which can't be modified or deleted, not even by ransomware) or a separate network.
This is probably the most important technical point — a backup that ransomware can encrypt isn't a real backup.
Ransomware that lies dormant for 3–7 days before activating = the recent backup already contains infected files.
The right answer: retention of at least 30 days, with daily versions.
Category 3: Backup testing (8–10)
The critical difference: checking that the backup ran ≠ checking that the restore works.
Many managers see "backup completed" and assume they're protected. They're not until the restore has been tested.
The right answer: yes, we've restored test files and they worked.
If the answer is "I don't know" or "more than 6 months ago", that's a problem.
GDPR Art. 32 requires regular testing of technical security measures.
Recommended standard: monthly for critical systems, quarterly for the rest.
If you don't know, you can't plan. If you can't plan, you can't communicate with clients and partners.
A full restore test gives you this number. Without it, your real RTO is "we don't know, we'll see when it happens".
Category 4: The continuity plan (11–12)
Memory + stress = bad decisions under pressure.
The right answer: a 1–2 page document covering who you call, what you do in what order, where the backup is and how you restore.
If there isn't one, we'll create it together — we do this for every client.
A human single point of failure = as dangerous as a technical single point of failure.
The right answer: documented procedures, with at least 2 people who know how to carry them out.
You'll be on holiday when it happens — Murphy guarantees it.
Your score
Read also
How many correct answers did you get?
If you've found vulnerabilities, we'll fix them together. Free assessment — we analyse the current situation and propose the necessary fixes.