Your backup says successful. Could you actually recover?

Start with what needs to keep working

The National Cyber Security Centre published technical recovery guidance on 1 October 2026. It highlights the need for tested backups, documented system dependencies and recovery information stored separately from everyday systems. Recovery involves more than retrieving documents. Applications, accounts and configuration may also need rebuilding.

For a small business, restoring the shared drive may not help if staff still cannot sign in or open the finance application. For a school, recovered teaching resources may be less urgent than access to attendance records and essential safeguarding information.

Choose one important service and ask what information it needs, which accounts and applications make it work, how long the organisation could operate without it and how much recent work could be lost. These answers give the recovery test a useful purpose. We have backups becomes we have demonstrated that this service can be recovered.

NCSC: Prepare your technical recovery capability

Check cloud recovery rather than assuming it

Microsoft 365 includes valuable recovery features. That does not mean every item remains recoverable indefinitely.

Microsoft documents a normal SharePoint recycle bin period of 93 days from the original deletion. Moving an item into the second stage does not restart that period. Earlier removal can occur through administrative deletion or quota related purging. Retention policies may affect the wider picture, so check the actual configuration.

The NCSC advises organisations not to rely solely on cloud version history and deleted item recovery for critical information. Its guidance recommends an independent copy in another safe place or service.

Ask your provider to identify exactly what is protected. Email, SharePoint documents, OneDrive files and information inside specialist applications can have different recovery arrangements. Synchronisation is useful, but it is not the same as a separate historical backup. An unwanted change or deletion may be synchronised too.

Microsoft: Restore deleted items from the site collection recycle bin

NCSC: Back up your organisation's critical data

Make sure an attacker cannot remove the recovery route

Backups need protection as well as storage. The NCSC's cloud backup principles address destructive changes, loss of customer access, older recovery versions, encryption keys and security alerts. Its guidance also considers how customers could regain access if their normal corporate systems were unavailable.

Where a supplier describes backups as immutable, ask what that means in the purchased service. The protection period, administrative exceptions and recovery arrangements matter more than the label. Do not weaken authentication to make emergency access easier. Agree and test a secure alternative beforehand.

• Check whether the same administrator account can delete both live information and its backups.
• Confirm that backups are protected against alteration or deletion for an agreed period.
• Name the people who receive alerts about missed jobs or changed retention settings.
• Make sure authorised staff could reach the backup service without their usual work email.
• Keep recovery instructions and encryption keys securely available.
• Appoint a deputy in case the main technical contact is absent.

NCSC: Principles for ransomware resistant cloud backups

Run a safe restore test

A sensible first test restores selected information to a separate, access controlled location without overwriting live work. For example, recover an older version of a spreadsheet, a folder with its permissions or an application database into a suitable test environment.

Ask the information owner to check the result. A file existing is not enough. It must open, contain the expected information and be usable by the right people.

Sensitive school or business information must remain protected during testing. Remove temporary copies afterwards using an approved process. An application or whole server test needs technical planning and suitable isolation. Recovered systems must not accidentally send emails, process payments or conflict with production services.

• Record the backup date and time selected.
• Note what was restored and where it was placed.
• Check whether permissions and attachments survived.
• Record any missing information or errors.
• Measure the time taken to obtain access and complete recovery.
• Confirm that the user could perform the intended task.

Measure recovery time, not just download speed

Time the complete process, including contacting support, obtaining approval, restoring information and checking that staff can work. A small file test does not prove that an entire server or Microsoft 365 environment can be restored within the same timeframe.

Also consider information created while systems are unavailable. Paper attendance records, manually recorded orders or temporary spreadsheets may need to be checked and reconciled after recovery. Include this work in the recovery plan and the time estimate.

If a cyber attack is suspected, restoring data is only part of the response. The technical team must assess the compromise and establish a safe recovery environment before reconnecting restored systems.

NCSC technical recovery guidance

Your practical recovery test checklist

Start with one important service this month. A controlled test that reveals a gap is useful evidence. It gives you an opportunity to correct the problem before recovery becomes urgent.

• Name the service being tested and its owner.
• Confirm what the backup includes and excludes.
• Agree acceptable downtime and potential data loss.
• Check access to instructions, accounts and encryption keys.
• Select a suitable historical recovery point.
• Restore into an approved separate location.
• Verify content, permissions and application behaviour.
• Measure the full time until the service is usable.
• Record failures, owners and completion dates.
• Repeat the test after significant changes and on a documented schedule.

How Bury I.T. Support can help

Bury I.T. Support Ltd can review backup coverage, arrange controlled restore tests and document practical recovery steps for businesses and schools.

We can help identify critical services, check whether Microsoft 365 and server information is included, protect the recovery route and test how long it takes to return a service to safe use. The result is a practical recovery record rather than an assumption based on a successful notification.