A green tick in your backup console means one thing: a job ran and finished without an error. It does not tell you that the right data was included, that the copy is intact, that it is safe from whoever might attack the rest of your network, or that you could bring systems back quickly enough for the business to carry on. Those are separate questions, and most small businesses have never asked them.
1. Is everything that matters actually included?
Backups are usually set up once, when a system is built, and then forgotten. New file shares, a new database, a cloud application or a laptop used by a director rarely get added afterwards. Ask for a simple list: each system or data set, whether it is backed up, how often, and where the copy goes. If nobody can produce that list, that is your first finding.
Do not forget cloud services. Microsoft 365 and Google Workspace keep your data available, but that is not the same as a backup you control. Ask what happens if a mailbox or a shared folder is deleted or encrypted, and how far back you could go.
2. Has anyone ever restored from it?
A restore test is the only real proof. It does not need to be dramatic: pick a file, a folder and, where you can, a whole system, and restore them somewhere safe. Note how long it took and whether the result was usable. A backup that has never been restored is an assumption, not a control.
3. How long would recovery take, and can the business live with that?
Two numbers matter. The first is how much data you can afford to lose, for example "work since last night". The second is how long you can be without the system. Compare those with what your backups actually deliver. A nightly backup of a system that the business cannot lose a day of work from is a mismatch, even if every job succeeds.
4. Is there a copy an attacker or a mistake cannot reach?
Ransomware and accidental deletion both go after whatever they can reach. If your backup storage is permanently connected to the same network, uses the same administrator account as production, and can be deleted by the same person, one compromised account can affect both. Look for at least one copy that is separate: offsite, offline or immutable, with different credentials.
5. Will anyone notice when it fails?
Backups fail quietly. Disks fill, credentials expire and agents stop. Check where alerts go. If they land in a mailbox nobody reads, or with a person who has left, failures can run for weeks. Someone should be named as responsible for reviewing backup health, and there should be a routine for doing so.
6. Is the recovery process written down?
During an incident, memory is unreliable. Recovery steps, access details, vendor contacts and the order in which systems should come back belong in a document that is stored somewhere you can reach even if your main systems are down.
What to do next
If you can answer all six with confidence, you are ahead of most small businesses. If several answers are "I don't know", the useful next step is a short, focused review rather than a large project.
A fixed-scope Backup Health Assessment looks at what is covered, how it is stored and protected, and whether restores would work, then gives you a written, prioritised list of what to fix. It is advisory: it does not guarantee recovery, and any remediation would be scoped and agreed separately.