Diarise the Restore: The Quarterly Backup Drill Your Business Can Actually Run

Most small businesses treat a backup dashboard like a fire alarm: if it is not flashing red, everyone assumes the building is safe. The useful question is not whether last night's job completed. It is whether you could get a real file, a real mailbox and a real business system back before the coffee goes cold. That is what a quarterly restore drill proves.

Why a restore drill beats a green tick

A green tick says software moved data somewhere. It does not say the data is readable, complete or restorable within a sensible time. It does not tell you whether the person who knows the encryption password is on holiday, or whether the backup box is sitting under the same desk as the server it is meant to protect.

A quarterly drill is a small, repeatable rehearsal. It is not a full disaster recovery exercise, and it should not need a weekend. Block out 90 minutes, choose a few genuinely important items, and try to bring them back. If it works, you have evidence. If it fails, you have found the problem while the office is still open and nobody is shouting.

Choose three real things, not a test folder

The temptation is to create a folder called backup-test, put a text file in it, restore it and call the job done. That proves almost nothing. Pick items that would cause a real problem if they vanished.

• A shared file. Use a live document from finance, operations or sales: a quote template, a customer list, a supplier contract. Restore it to an alternate location, open it, check the version and confirm the permissions are sensible.
• A mailbox. Choose a shared mailbox or a leaver's mailbox and restore a specific item from three months ago. Check the attachment opens, the calendar entry is intact and the folder structure survives. Do not restore over the live mailbox.
• A line-of-business data set. That might be your CRM export, practice management system, stock database or accounts package. Work with the vendor or your IT support provider on the correct restore method. The goal is a usable copy in a staging area, not a heroic overwrite of live data.

Write down what you picked and why. Next quarter, pick something different. Over a year, you will have tested more of the estate than any single hero restore ever would.

Give the drill an owner and a deputy

A restore drill with no owner becomes a calendar suggestion that everyone ignores. Make the operations lead or office manager the drill owner. They do not need to know how the backup software works, but they do need to chase the evidence, keep the log and escalate when something fails.

Your IT support provider supplies the technical hands and the screenshots. The business supplies the judgement about what matters. Name a deputy as well, because the week you choose will be the week the owner is on annual leave. Keep it non-blame: the point is to find gaps, not to audition for a tribunal.

The 90-minute running order

1. Before the drill, confirm the target restore location, check licences and tell the people who use the data that a copy is being tested. No surprises on a Tuesday morning.
2. Start a timer. Recovery time matters. A restore that technically works after 14 hours is a different conversation.
3. Restore to an alternate folder or staging area. Never overwrite live data during a drill.
4. Validate properly. Open the file, read the mailbox item, run a report from the line-of-business copy. Check dates, attachments and permissions.
5. Record the result. Date, owner, system, item tested, time taken, what broke and the ticket reference.
6. Clean up. Delete the test copy, or lock it away if you need evidence for an insurer or client.

If a restore takes longer than expected, note it. If it fails, log the reason and book a retest for four weeks later. Do not let a failed drill sit in a spreadsheet until next quarter.

Write down the awkward bits

Keep a simple restore log in a shared drive or intranet page. It should record the date, the drill owner, the system tested, the recovery time objective you were aiming for, the actual time taken, what went wrong and the follow-up ticket. Add a short note on whether the business could have carried on if this had been a real outage.

That log is more useful than a dashboard screenshot. It shows trends: the same NAS restore that keeps timing out, the mailbox that always needs a support call, the line-of-business vendor who takes two days to respond. Review it once a quarter alongside your other operational risks.

The traps that only appear when someone presses Restore

The NAS beside the server. A NAS box in the same room as the server is convenient, but it shares the same power, the same network and often the same ransomware event. A restore drill should include an offline or immutable copy if you have one. If you do not, that is a finding.

Cloud sync is not a backup. SharePoint and OneDrive version history is useful, but a sync client will happily sync a deletion or an encryption event. Check what your cloud backup actually covers and how far back it goes.

Microsoft 365 assumptions. Retention policies are not the same as a backup. Check whether shared mailboxes, Teams files, SharePoint libraries and permissions are in scope. Then test a granular restore: one email, one file, one folder. Restoring an entire site is a different skill from restoring one contract.

Keys and passwords in the same building. If the encryption key or backup admin password is stored only on the server that failed, the restore is going to be a long day. Keep recovery credentials somewhere separate and test that the right people can reach them.

Speed and throttling. Cloud restores can be slow. A large mailbox or a busy file share may take hours over a standard UK broadband line. Measure it during the drill rather than discovering it during an incident.

Make it boring, then make it routine

A good restore drill is dull. It has a calendar invite, a named owner, a short checklist and a log that gets updated. Put it in the diary for the same week each quarter. Start with one file and one mailbox if that is all you can manage, then add the line-of-business system once the routine sticks.

A backup you have never restored is a hope, not a plan. The quarterly drill turns it into something you can show a client, an insurer or your own management team: evidence that the business can actually get its data back.