Backups you have actually restored

Every institution says it has backups. Fewer know whether those backups would bring the office back after a ransomware attack, a dead server or a deleted folder. A backup only counts once someone has restored from it.

What CISA says

CISA's #StopRansomware Guide gives the core rule: maintain offline, encrypted backups of critical data, and regularly test their availability and integrity.

The guide explains why offline matters. Most ransomware attackers try to find backups they can reach, then delete or encrypt them, so the only way to recover is to pay. A copy that is disconnected, or that the attacker's stolen password cannot change, survives.

Sync is not a backup

Shared folders that sync to the cloud feel like backups, but they copy every change, including the bad ones. CISA's guide warns that if files on a computer are encrypted, the encrypted versions can sync to the cloud and overwrite the good copies.

Version history in a sync service helps, sometimes a lot. Treat it as a convenience, not as your recovery plan, unless your IT contact has checked how far back it goes and who can delete it.

A rule of thumb

A common rule of thumb is 3-2-1: three copies of what matters, on two different kinds of storage, with one kept off-site or offline. It is a starting point for a conversation with whoever runs your backups, not a law.

What to back up

Make a short list of what the office cannot run without:

• the finance, payroll and utility billing systems,
• permits, licenses and records databases,
• shared drives with current work,
• the website: its files and its database,
• email, after checking what your email provider keeps and for how long,
• the passwords and setup notes needed to rebuild all of the above.

The last one is often missed. A perfect backup is useless if the only person who knows how to restore it is unreachable, or the instructions were on the encrypted server.

Test it: the small restore

You do not need a disaster to test. Once a quarter, try this:

1. Pick one file from last month, one folder, or one day of a database.
2. Restore it to a different place, so you do not overwrite current work.
3. Open it. Check it is complete and readable.
4. Write down how long it took and who did it.

Then scale up. Ask how long a full restore of the most important system would take, and whether anyone has ever timed it. The answer is often "we don't know," and that is worth knowing now.

Backups and public records

Backups exist so you can recover. They are not your records program. What you must keep, and for how long, follows your state's records retention rules and your institution's schedule. Ask your clerk or records officer how the two fit together.