Backups you've never restored aren't backups: a restore-test plan for Australian SMEs

Most businesses we talk to can answer "do you have backups?" with a confident yes. Far fewer can answer "when did you last restore something important, end to end, and check it worked?"

That second question is the one that matters on a bad day. A backup job showing a green tick tells you a copy was made. It doesn't tell you the copy is complete, that it opens, or how long it takes to get your business running again from it.

This post is a practical plan to close that gap. No scare tactics, just a routine you can run every quarter.

What the ACSC actually says about backups

"Regular backups" is one of the eight strategies in the Australian Signals Directorate's Essential Eight. The Essential Eight maturity model lists these requirements at Maturity Level One:

• "Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements."
• "Backups of data, applications and settings are synchronised to enable restoration to a common point in time."
• "Backups of data, applications and settings are retained in a secure and resilient manner."
• "Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises."
• "Unprivileged user accounts cannot access backups belonging to other user accounts."
• "Unprivileged user accounts are prevented from modifying and deleting backups."

Notice that restore testing is listed alongside making the backups, not as an optional extra. The ASD's Essential Eight assessment process guide (October 2024) adds that restoration should be tested "as part of regular (at least annually) disaster recovery exercises and not left until after the first major security incident is experienced", and that "business-as-usual recovery of user files is not sufficient". The intent is "the restoration of a significant component of a system as part of a scheduled exercise".

The higher maturity levels tighten who can touch backups. At Maturity Level Three, for example, "Backup administrator accounts are prevented from modifying and deleting backups during their retention period." For most SMEs, Level One is the sensible place to start.

The ACSC's small business cyber security guide puts it more simply: "Test your backups regularly by attempting to restore data."

We covered how Essential Eight fits into the government's new small business certification in our CyberSmart post. This one goes deep on a single strategy.

What to back up in a typical Australian SME

The ACSC says backups "must be carefully scoped to ensure that they cover all information an organisation requires to recover from a cyber security incident, this typically includes important data, software and configuration settings" (ACSC, Technical example: Regular backups).

In practice, that usually means listing:

• Microsoft 365. Email (Exchange), OneDrive, SharePoint and Teams. The ACSC notes that "Microsoft's service agreement recommends performing backups using third-party software" and recommends a third-party solution that "backs up and restores Exchange, SharePoint, OneDrive, Teams data" (ACSC). Don't assume "it's in the cloud" means "it's backed up".
• Accounting. Whether you use a cloud platform or a desktop file, find out what your provider keeps, for how long, and what you can export yourself. Keep your own periodic exports of key reports and records.
• Job, CRM and line-of-business systems. These are often the systems the business actually runs on, and the ones least likely to have been tested. Ask the vendor how a restore works and who does it.
• File servers and on-premises servers. Include the server's settings and applications, not only the shared folders. If an older server is still in service, our Windows Server 2016 end-of-support plan is worth a read too.
• Cloud servers and services. Virtual machines, databases, and the configuration that makes them work.

Write the list down, with an owner for each system. That list is the start of your restore plan.

Keep at least one copy ransomware can't reach

Ransomware often goes after anything it can reach on the network, including backups. The ACSC's guidance is consistent here:

• "Always keep at least one backup disconnected from your device, preferably at an offsite location in case of natural disasters or theft" (ACSC small business guide).
• "Your backups may be affected if they were stored on the infected device or connected to the same network." If you think a backup is infected, don't access it (ACSC, Steps to take following a ransomware attack).
• "Do not connect your backup to devices that are infected with ransomware or viruses" (ACSC small business guide).

Two practical ways SMEs do this are an offline copy (a drive or device that's disconnected after each backup and stored securely), or storage that can't be changed or deleted for a set period, often called immutable storage. The second lines up with the Essential Eight idea that accounts, even admin ones at higher levels, are prevented from "modifying and deleting backups". Either way, also protect backup admin logins with multi-factor authentication, as the ACSC recommends for backup tools (ACSC).

A quarterly restore drill: the owner's checklist

The ACSC's assessment guidance asks for restore testing as part of regular (at least annually) disaster recovery exercises. We suggest a quarter as a practical rhythm, because it lets you cycle through your main systems over a year. That's our recommendation, not a regulation.

Each quarter:

1. Pick one system from your list. Rotate so every important system gets a turn.
2. Choose a point in time to restore to, such as last Friday night.
3. Restore to a safe place. A test machine, a separate cloud environment or a spare folder. Never overwrite live data during a drill.
4. Check it actually works. Can someone open the files, log in to the system, run a report or find last week's invoices? Check settings and applications, not only data.
5. Time it. Write down how long it took from "start" to "usable".
6. Write down the gaps. Missing data, forgotten passwords, steps only one person knew, a vendor you had to call.
7. Fix one thing before next quarter, and record the result. The ACSC's assessment guide says a post-exercise report is ideal for showing what was tested and what was learnt.
8. Check the offline or immutable copy is current and that you know how to get to it.

Keep the notes in one place. After a year, you'll have a realistic picture of what recovery looks like, instead of a guess.

How often to back up, and how long to keep it

The Essential Eight doesn't set a single frequency. It says backups should be performed and retained "in accordance with business criticality and business continuity requirements" (maturity model). The assessment process guide asks assessors to discuss the frequencies specified for the system and to check that those frequencies and retention periods are documented in the business continuity plan. In other words, write the frequencies down as the system owner, then stick to them.

The ACSC's practical test is helpful: "consider how many days of work your organisation is willing to lose in the event of an incident and schedule your backups accordingly" (ACSC). The small business guide makes the same point: "Consider what you can afford to lose in a worst case scenario."

As owner guidance (practice, not regulation):

• Systems that change all day, like email, accounting and job systems, usually justify daily or more frequent backups.
• Keep enough history to go back before a problem was noticed, since issues aren't always spotted on day one.
• Check any record-keeping obligations that apply to your business with your accountant or adviser, so retention matches them.

Where OrionX fits

Backups tend to fall through the cracks when a business grows. Systems get added one at a time, each with its own idea of what "backed up" means, and nobody owns the whole picture. Getting it tidy is usually a mix of knowing what you have, connecting the pieces sensibly and making restores repeatable. That's the kind of operational mess our cloud solutions and system integration work is built to fix.

Start with a free 20–30 minute chat about your backups and how confident you are in restoring them. If it's a good fit, we'll follow up with one free demo tailored to your setup (one per business). No pressure, just a clear picture of what to do next.

Sources

• ASD/ACSC, Essential Eight explained
• ASD/ACSC, Essential Eight maturity model
• ASD/ACSC, Essential Eight assessment process guide (October 2024, PDF)
• ASD/ACSC, Essential Eight assessment process guide hub
• ASD/ACSC, Technical example: Regular backups
• ASD/ACSC, Small business cyber security guide (First Nations A4 PDF)
• ASD/ACSC, Steps to take following a ransomware attack