Restoring a critical system when backups have not been tested

This is a fictional learning scenario. It does not describe a Cyberxperts client, incident or completed engagement.

The situation

Imagine a business whose daily operations depend on a shared records system. Backups run automatically, but nobody has recently demonstrated a full restoration. An outage raises a practical question: can the business recover the records and resume work in the order that matters?

The proposed scope

A recovery review would identify critical records, system dependencies, responsible people and the access needed to restore them. It would examine the difference between a backup completing and a usable system being recovered. Business owners would agree which activities take priority and what loss of recent work they can tolerate.

The proposed exercise

The team would plan a controlled restoration in a suitable test environment. They would record the steps, check the recovered information and confirm that the application can use it. Any missing access, unclear responsibility or unresolved dependency would become an action with an owner.

What would demonstrate progress

Evidence should include a completed restoration record, agreed recovery priorities and instructions that another authorised person can follow. Recovery times would be measured during the exercise, rather than estimated for a sales claim. A successful exercise applies to the tested scope and conditions; it is not a promise about every future outage.

Apply this to your organisation

Ask when your team last tested restoration, what was recovered and who verified it. Use the security checklist, explore Risk Assessments, or begin with the complimentary Pre-Assessment.

Download the security checklist PDF to record questions for your recovery review.

Further reading

NCSC guidance for small organisations includes guidance on protecting accounts and backing up data.