Cybersecurity Awareness Month, Week 4: "We Have Backups" Is Not the Same as "We Can Recover"

Over the past three weeks we've covered the basics worth checking, passwords and MFA, and software updates. This week: the safety net everyone assumes is working until the day they need it.

Ask most business owners whether they have backups and the answer is a confident yes. Ask whether they've ever restored from those backups, how long it took, and whether anything was missing, and the confidence tends to drop. That gap is where businesses get hurt.

Why Having Backups Isn't Enough

A backup is only valuable if it can actually be restored, quickly, and with the data you need. We regularly see situations where:

• Backup jobs have been failing silently for weeks or months

• Backups exist but nobody knows how long a full restore would take

• Backups are stored on the same network as the original data, so ransomware encrypts both

• Critical systems (the EHR, the POS, the donor database) were never included in the backup scope

Ransomware attackers know this. Many specifically hunt for backup systems first, because destroying the safety net is what makes paying the ransom feel like the only option.

The Questions That Actually Matter

Instead of "do we have backups," ask:

1. How long would a full recovery take? Hours, days, or weeks? Could your business operate that long without its systems?

2. How much data could we lose? If the last good backup was 24 hours old, are you comfortable losing a full day of records or transactions?

3. Is at least one copy isolated from our main network? An offsite or immutable copy can't be encrypted or deleted by an attacker who gets inside.

4. When did we last test a real restore? Not "the backup job reported success," but an actual restore of real data.

A Simple Standard to Aim For

A widely used rule of thumb is the 3-2-1 approach: three copies of your data, on two different types of storage, with one copy kept offsite or isolated. It isn't the only way to do it, but it's an easy benchmark for checking whether your current setup has obvious gaps.

What To Do This Week

1. Confirm which systems are actually included in your backups, and which aren't.

2. Ask whoever manages your backups for the most recent successful restore test, and the date.

3. Check whether at least one copy sits outside your main network.

4. If you don't have a written plan for how the business keeps operating during an outage, start a simple one: who gets called, what gets restored first, and how staff work in the meantime.

The Bottom Line

Backups are the difference between a ransomware incident being a bad week and being the end of the business. But only if they work when it counts. A short, scheduled restore test is one of the cheapest ways to find out before you have to.

Next week: wrapping up Cybersecurity Awareness Month with the question we get asked most often, and what a practical security baseline actually looks like for a small organization.

Sentinel Technology Solutions helps healthcare, hospitality, and nonprofit organizations build IT environments that are secure, compliant, and resilient. Reach out if you'd like a no-pressure look at how your backup and recovery setup would actually hold up.