4 MIN READ · PRACTICAL GUIDE
The most useful backup question is not “Did the job run?” It is “Can the right people restore the right information in time to resume work?” A recovery drill turns that question into evidence.
This guide is intended for small businesses using cloud applications in the UK and Europe. The drill below is an editorial example, not a certification or a guarantee of recovery.
Choose a process before choosing a backup product
The UK’s National Cyber Security Centre advises organisations using cloud services to check that essential data is backed up and can be restored. Its guidance also warns against relying solely on built-in version history or short-term deleted-file recovery; an independent copy may be needed.
Apply that principle to one business process. For example, could the finance team still identify unpaid invoices if its normal application became unavailable? List the records, attachments, permissions and reference information needed to perform that task. Include the people who must use the restored data, not just the administrator who can access the backup console.
Two planning questions help: how much recent work could the business reconstruct, and how long could the process remain unavailable? Express the answers in operational terms. “We can re-enter this morning’s orders from another record” is more informative than choosing a recovery target because it sounds impressive.
Prepare a safe, limited drill
Use a test environment or a clearly isolated destination. Do not overwrite production records to prove that a backup works. Choose representative data with permission from the responsible owner, minimise personal information and restrict access to the recovered copy.
Write down the starting conditions. Can the test administrator sign in? Are encryption keys and recovery credentials available through an authorised process? Does the restore depend on the same account or service assumed to have failed? A backup stored elsewhere can still be unusable if the recovery process depends entirely on a compromised identity.
| Test condition | Evidence to collect |
|---|---|
| Availability | The selected backup can be located and read |
| Completeness | Expected records, files and relevant relationships are present |
| Accuracy | Sample amounts and record counts reconcile |
| Access | Authorised users can work; other users cannot |
| Usability | A business owner completes the selected task |
| Cleanup | The test copy is removed or retained under an agreed purpose |
Measure the whole recovery, including the handover
Record when the incident simulation begins, when recovery starts and when the business owner confirms that the task can be completed. Technical restoration time is only part of the interruption. Waiting for an available administrator, locating the correct backup or understanding an unfamiliar export can dominate the result.
For an illustrative test, restore a sample customer record, an unpaid invoice and its supporting document. Verify the amount, currency, due date and link to the customer. Then ask an authorised colleague to produce a list of outstanding invoices from the restored information. That final task tests usefulness rather than the mere existence of files.
If a restore requires a support ticket, include the support dependency in the runbook. Do not assume a response time unless it is supported by the contract and the incident conditions. Keep a safe fallback process for essential work while restoration is pending.
Record failures as work items
A drill that reveals missing attachments has produced valuable information. Assign a named owner and due date to fix the cause, then repeat only the relevant acceptance test. Avoid reducing the report to a green or red overall status with no explanation.
Use a short record: scope, backup date, start and finish times, records sampled, discrepancies, access results, cleanup action and outstanding issues. Limit the report to the information needed for assurance; it should not become another uncontrolled copy of customer data.
Review the drill after a significant application change or a new integration. A migration can alter what the backup contains, and a permission change can alter who can recover it. Our cloud exit guide addresses the related question of moving data to another service.
Frequently asked questions
Is synchronisation a backup?
Do not assume so. A synchronised deletion may affect multiple locations. Check the actual recovery capabilities, retention and separation rather than relying on the label.
Can a spreadsheet export serve as a fallback?
Sometimes, for a clearly defined temporary process. It may omit attachments, history or permissions and should not automatically be treated as a full system backup.
Source and scope
Primary source checked 14 November 2026: NCSC: Back up your organisation’s critical data. The drill, sample records and acceptance table are our practical suggestions, not a prescribed NCSC test.