Backup Restore Testing and Recovery Evidence
A backup is only proven when it has been restored. We review what you have tested, how long it took and whether the evidence would satisfy an auditor.
Only 54% of ransomware victims restored from backups
Sophos’ 2025 survey found backup use for recovery at its lowest rate in six years. Untested backups are one reason.
Auditors and insurers ask for restore records, not screenshots
We check that each test records what, when, how long and the result.
What a restore test should prove
NIST CSF 2.0 lists “backups of data are created, protected, maintained, and tested” as outcome PR.DS-11, and asks organizations to verify backup integrity before using backups for restoration (RC.RP-03). Source: NIST Cybersecurity Framework 2.0 (CSWP 29).
A good restore test proves three things: the data is complete and uncorrupted, the restore finished within the recovery time objective, and someone recorded it. The audit reviews your records against those three points.
Because the audit is read-only, we do not run restores ourselves. If your team runs a test during the audit window, we observe it and record the result as evidence.
Restore tests and suggested frequency
| Test type | Suggested frequency | Evidence to keep |
|---|---|---|
| File and folder restore | Quarterly | Ticket, files restored, time taken |
| Full server or VM restore | Annually per tier 1 system | Start and end time, result, compared with RTO |
| Database and application restore | Annually, with the application owner | Owner sign-off that the application works |
| Microsoft 365 or SaaS restore | Annually per workload | Items or site restored, time taken |
| Restore from the immutable or off-site copy | Annually | Copy used, time taken, integrity check |
| Identity restore (domain controller) | Planned and tested at least once | Runbook and test record |
Frequencies are common practice, not legal requirements. Your frameworks, contracts or insurer may require more.
What we look for and why
Measure the time
The most useful number in a restore test is how long it took. Compare it with the RTO and record the gap.
Check the data
Restored data should be checked for completeness and malware before it goes back into production.
Fix and retest
A failed test is valuable. It should create a ticket and a retest date, not disappear.
A finding from the sample report
- Area
- Restore testing and evidence
- Finding
- No full restore test recorded in 22 months
- Severity
- High
- Evidence
- Backup job reports show daily success. The only restore records are single-file restores for users. No server, database or Microsoft 365 restore has been tested since January of last year, and the cyber insurance application states restores are tested quarterly.
- Fix
- Run and document a full restore of each tier 1 system, correct the insurance application answer with your broker, and put quarterly and annual tests on the calendar.
Every finding in the real report has this shape. See the full sample report
A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Where to go next
RPO, RTO, uptime and availability
Targets that restore tests must meet.
Incident response tabletop generator
A tool to plan an outage exercise.
Want a quick self-check first? Backup and disaster recovery self-assessment · Ransomware recovery cost estimator
Page 9 of 16: Restore testing & evidence
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence (this page)
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
How often should we test restores?
Common practice is quarterly file restores and at least annual full restores of each critical system, plus a test after major changes. Your frameworks, contracts or insurer may require more.
Will you run the restore test?
No. The audit is read-only. Your team or your IT provider runs the test, and we observe and record it if it happens during the audit window.
Do you sell backup products?
No. OC Security Audit does not resell any backup product and earns no referral fees. If you want help installing or reconfiguring the product you choose, IT Perfection can do that work separately.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Turn backups into restore evidence
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.