How to Audit Backups in 8 Read-Only Steps
A practical first pass an IT administrator can run without changing anything. Then decide whether you need an independent audit.
Look, record and compare. Change nothing yet
Each step only reads settings and reports, so you can run it during business hours.
Most gaps are coverage, isolation and testing
These eight steps find the common ones fast.
What you need
- Read access to each backup console and cloud backup portal
- Your server, VM and cloud asset list
- The DR plan, the last backup reports and any restore test records
- An hour with the owners of your most important systems
Change nothing during these steps. Write down what you see; fixes come after.
How to audit backups step by step
Build the inventory
List every server, VM, database, NAS, cloud workload and SaaS app that holds business data, with an owner for each.
Match inventory to backup jobs
Export the protected-items list from each backup product and Microsoft 365 backup. Mark every inventory item protected or not.
Write down RPO and RTO
For each critical system, record how much data and how much downtime the owner can accept. Compare backup frequency with the RPO.
Check the 3-2-1-1-0 copies
For each critical system, count copies, media types, off-site copies and offline or immutable copies. Note where each copy lives.
Check immutability settings
Open the retention lock or object lock settings. Record the mode, the period and which accounts can change or bypass it.
Review backup console security
Check MFA, which accounts can sign in, whether the server is domain-joined, where encryption keys are stored and which alerts exist.
Collect restore records
Find the last file, server, database and Microsoft 365 restore tests. Record dates, durations and results, and compare durations with RTOs.
Read the DR plan
Check that it is current, has runbooks and contacts, is reachable offline and was exercised in the last 12 months.
Eight steps are a start, not an audit
These steps find the common gaps: missing coverage, no immutable copy, weak console security and untested restores. A full audit adds 96 checks with evidence, measured restore times against your RTOs, compliance mapping and a prioritized roadmap.
Page 16 of 16: How to audit backups
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups (this page)
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Want the full 96 checks done for you?
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.