Almost everyone we check has a backup. Far fewer have ever restored from one. That gap is where the trouble lives, because a backup only exists to be restored, and the day you find out whether it works should not be the day you actually need it. The test is not clever. It is simply doing the thing on purpose, once, while nothing is on fire.

The reasons backups quietly fail are dull and common. The job stopped running months ago and no one saw the email. It backs up the wrong folder, or everything except the one database that matters. It saves fine but the file is corrupt, or the only person who knows the password has left. None of these show up until you try to bring something back.

So book twenty minutes. Pick one genuinely important file or a small database, restore it to a safe location, open it, and confirm it is real and current. Then write down three things: how long it took, whether it actually worked, and who did it. That written line is what turns ‘we have backups’ into evidence you can stand behind, which is exactly what a regulator or an insurer will ask to see.

If you are covered by DSPT, Cyber Essentials or any assurance scheme, this is not optional gold-plating; it is the part they mean when they ask whether backups are tested. And if you are a sole trader with everything on one laptop, it matters more, not less - there is no colleague's copy to fall back on. Do it once a quarter and diarise the next one before you close the laptop.