Two questions: how much data and how much time
A backup strategy starts with a business question: how much data can you lose and how long can a system stay unavailable.
RPO describes acceptable data loss, while RTO describes how quickly the system must return. Without that, every tool is a guess.
What a restore test must cover
Restoring one file is not enough. For a serious check, choose scenarios: a user deleted a folder, a database is corrupted, a server is down or ransomware locked a share.
The test must measure duration, required accounts, dependencies and steps another person could follow.
- Single-file restore
- Database or application restore
- Full virtual machine restore
- Offsite copy check
3-2-1 as the minimum
A practical minimum is three copies of data, on two different media or systems, with one copy offsite. For ransomware risk, add isolation or immutable storage.
The key point is that the backup account must not be the same admin account an attacker can compromise through the domain.
A report management understands
A good backup report is not only green or red. It should say what was tested, how long it took, what is not covered and what risk remains.
Then backup stops being technical fog and becomes part of business resilience.