The question is not whether backups run, but whether the business can recover.
Backups are one of the most important controls in business continuity and cyber resilience. Yet many organisations only discover backup weaknesses during an outage, ransomware incident or system failure. Backup success messages can create comfort, but they do not prove that data can be restored when the business needs it.
A backup environment must be complete, protected, monitored and tested. It should cover critical systems, be aligned to recovery expectations and be protected from accidental deletion, technical failure and cyberattack.
Why this matters
Ransomware has changed the backup conversation. Attackers may try to delete or encrypt backups before launching the main attack. Organisations therefore need to consider backup isolation, restore testing, ownership and recovery prioritisation.
What management should consider
- Identify which systems and data are critical to operations.
- Define recovery time and recovery point expectations.
- Confirm whether backups are protected from ransomware and privileged misuse.
- Test actual restores and document the results.
- Monitor backup failures and escalate unresolved issues.
- Include cloud and SaaS data in backup discussions.
- Review whether backups support business continuity requirements.
Common pitfalls to avoid
Relying on backup success messages only.; Not testing restores for critical systems.; Forgetting that cloud data may also require backup consideration..
Key takeaway
A backup that has not been restored and tested should not be assumed to be a recoverable backup.
Practical first step
Ask for evidence of the most recent successful restore test for each critical system, not only evidence that backup jobs completed.
How Nexia SAB&T can assist
Nexia SAB&T can assist with backup and recovery reviews, disaster recovery assessments, ransomware readiness reviews and business continuity control reviews.
Author details: Rob Galetti | IT Audit and Cybersecurity | Nexia SAB&T
Date: 30 September 2026
