Restore one file. Then you’ll know.
Every school we look after has a backup. Ask the office and someone will tell you it runs every night. Usually that’s true. The backup runs, and there’s a green tick on a dashboard somewhere.
What almost nobody can tell me is when a file was last brought back from it.
That’s the only test that counts. A backup job that finishes every night tells you data was copied somewhere. It doesn’t tell you the copy is complete, readable or recent, or that anyone knows how to get it back. You find those things out when you restore something. If the first time you restore something is the morning after a ransomware attack, you’re finding out at the worst possible moment.
The restore test
It takes about twenty minutes. Do it with whoever looks after your IT, whether that’s someone in-house, us, or another company.
- Pick a real file that matters. A pupil tracking spreadsheet, a staff rota, the SEND register. Not a test file someone made for the purpose.
- Ask for yesterday’s version of it to be restored to a different location. Don’t overwrite the live one.
- Open it. Check it’s the version you expected, and that it isn’t empty or corrupted.
- Write down how long it took, from asking for it to having it open on screen.
- Write down the date and who did it.
That’s it. Do it once a term and keep the notes with your cyber response plan.
What usually goes wrong
When a restore test fails, it’s rarely because the backup software is broken. It’s usually one of these.
The thing that matters isn’t in the backup. The server’s backed up, but the finance spreadsheet lives in someone’s OneDrive or on the desktop of the office PC. The backup covers whatever someone set it up to cover three years ago.
Nobody knows how to get it back. The person who set it up has left. The login for the backup portal is written in a notebook. The supplier’s support line wants a contract number nobody can find.
It’s all on the same network. If your backup sits on a drive in the same building, on the same network, behind the same admin account, ransomware will find it. Attackers look for backups first. That’s why the DfE’s cyber security standard for schools asks for at least three backup copies of important data, on at least two separate devices, with at least one off-site.
Microsoft 365 isn’t backed up separately. This catches a lot of schools. OneDrive and SharePoint keep your files available and keep some version history. That isn’t the same as a separate backup you control. If an account is deleted, or a folder is wiped and nobody notices for a few months, you may not be able to get it back.
How long would it take to get going again?
The restore test tells you about one file. The bigger question is how long it would take to get the school running if everything went down on a Monday morning.
For most primaries the honest answer is that nobody knows. That’s fine as a starting point. Pick the three systems you can’t run a day without. For most schools that’s the MIS, email, and wherever your safeguarding records live. Ask your IT support how long each would take to bring back from backup, and how they know.
If the answer is a guess, you’ve found your next job.
If you’re on the RPA
If your school or trust uses the DfE’s Risk Protection Arrangement, offline backups are one of the conditions of its cyber cover. You’ll want to be able to show they exist and that they’ve been tested. A dated note from your restore test is good evidence.
Do it before Christmas
The Christmas holiday is the longest stretch of the year with nobody in the building. If something goes wrong on 23 December, you want to already know your backup works.
If you’d like us to do the restore test with you, or you’re not sure what your backup actually covers, book a free 30-minute call. No pitch.
Restore one file. Then you’ll know
Useful Links:
The 3-2-1 backup strategy – DfE Cyber Security Hub
Risk protection arrangement (RPA) – DfE Cyber Security Hub