Hope Is Not a Recovery Strategy: Why Untested Backups Are the UK's Most Expensive Assumption

There is a moment, common to many IT post-mortems, when someone asks the question nobody wants answered: has anyone actually tried restoring this? The silence that follows is usually more revealing than any audit report.

The uncomfortable truth about business continuity in the UK is that a great many organisations hold backups they have never meaningfully tested. The backups exist. They are scheduled, they tick along nightly, and they generate reassuring confirmation emails. But existence is not capability. Until data has been restored — fully, under time pressure, by the people who would actually do it — the backup is not a recovery plan. It is a hope with a cron job.

The Gap Between Backup and Recoverability

Backups fail in ways that only become apparent during a restore. Files may be captured but corrupted. Databases may be dumped without the configuration needed to run them elsewhere. Applications may depend on services, credentials, or DNS entries that sit outside the backup perimeter entirely. A backup of an application is not the same as a backup of the environment that application requires.

These failure modes are invisible from the outside. A monitoring dashboard showing successful nightly jobs tells you nothing about whether a Wednesday morning restoration would produce a working business. Only a rehearsal can answer that question — and rehearsal is precisely what most firms skip, because it is disruptive, time-consuming, and easy to defer.

The Compliance Dimension

UK data protection expectations do not merely ask whether an organisation holds copies of its data; they ask whether the organisation can maintain availability and resilience of the systems processing it. Under UK GDPR, the principle of integrity and confidentiality extends to the security of processing, and accountability obligations require firms to demonstrate appropriate measures — not merely assert them.

A business that cannot evidence restore testing is in a difficult position when asked to demonstrate resilience. The same applies to sector-specific regimes: financial services firms operating under FCA operational resilience rules are explicitly required to test their ability to remain within impact tolerances, and firms in regulated sectors increasingly find that regulators regard an untested backup as equivalent to no backup at all.

Insurers, too, are sharpening their questioning. Cyber insurance proposals now routinely ask for evidence of restore drills, and a policyholder who cannot produce documentation may find claims contested or premiums inflated.

A Practical Rehearsal Framework

Testing recoverability does not require an enterprise budget. It requires scheduling and discipline. A workable framework for a UK SME looks something like this:

Monthly: targeted restores. Select a single system or dataset and restore it to an isolated environment. Verify not just that files return, but that the application functions. Rotate the target so every critical system is exercised at least quarterly.

Quarterly: timed recovery of a key system. Restore a business-critical application and measure the elapsed time against your stated recovery objectives. If the recovery time objective is four hours and the exercise takes eleven, the discrepancy is better discovered in a drill than in an incident.

Annually: full environment rehearsal. Once a year, attempt a complete rebuild of a production environment from backups alone, in a sandbox. Document every dependency that had to be reconstructed from memory. Each undocumented dependency is a finding — and a fix.

Continuously: documentation as you go. Every restore exercise should update runbooks. The knowledge in one engineer's head is not a procedure.

Treat the Drill as the Deliverable

The cultural shift required is modest but essential: businesses must stop treating the backup as the deliverable and start treating the restore as the product. A backup that has never been restored is a hypothesis. A restore that has been rehearsed, timed, and documented is evidence — evidence that satisfies auditors, reassures insurers, and, when the worst day arrives, keeps the business running.

The question every board should be able to answer is not whether backups exist. It is when the last full restore was performed, how long it took, and who signed it off. If those answers are not immediately available, the continuity plan is unfinished.