Background
Many SMEs believe they have backups, but no one has ever tested restoring from them. Behind the green dashboard sit the questions that actually matter: how long it would take to recover (your RTO), how much recent work you'd lose (your RPO), whether the backups themselves can be locked or deleted by ransomware (whether they're immutable), whether you can rebuild a server from scratch (a bare-metal restore), and whether you're actually backing up the right things at all — Microsoft's shared responsibility model means your Microsoft 365 data is your problem, not theirs.
Questions to ask yourself
- What exactly is backed up — and what isn't?
- How often are backups taken, and where do they go?
- Has anyone actually tested a restore recently?
- Could ransomware destroy the backups as well?
- Are Microsoft 365, emails, and SharePoint also being backed up?
What you can do today
Prove your backups, free
Three actions.
- 01Pick a non-critical file. Delete it. Try to restore from backup. Time how long it takes. That's your real recovery time.
- 02Email your IT supplier: “Send me the dated screenshot of the most recent successful end-to-end restore test.”
- 03Check whether your Microsoft 365 data is in any backup. Microsoft's shared-responsibility model says it's your job.