Backups are not recovery: the ransomware test that matters

The decision behind the headline

This review focuses on backup isolation, restoration speed, clean systems and essential service priorities.

A backup test should end with a usable business process, not a green software status. Choose one critical workflow such as invoicing, then restore its data, application and required permissions into a safe test environment. Record when a staff member can actually complete the task. Ask the IT provider whether backup administration is separated from ordinary production credentials and whether a compromised administrator could alter both. BACS’s guidance on separated copies supports this distinction; a connected copy may share the incident’s exposure.

A hypothetical scenario to test

A wholesaler has daily backups, but the administrator discovers the backup account was also compromised. This is an invented example, not a reported claim or a promised payout. Reconstruct the sequence from the first sign of trouble to ordinary service resuming. Ask what would happen if the problem occurred during a holiday or at the busiest time of year. The stress test should expose assumptions about availability and timing before they are relied upon.

For the wholesaler, compare a one-day restore with a five-day rebuild, both hypothetical. Orders waiting in the queue may be recoverable, while missed dispatch windows may create permanent consequences. Estimate them separately. Ask the insurer to distinguish restoration costs from interruption waiting periods and any extortion benefit. A payment-related provision does not prove that paying an attacker restores usable information or resolves stolen data. Keep a qualified incident team involved rather than improvising negotiation. The strongest review documents a tested recovery time, clean dependencies and the expense categories the proposed contract actually recognises.

Identify the contractual boundary

BACS recommends separated backups because connected copies can be attacked too. Test not only that files exist, but that the needed application and permissions can operate after restoration. A restored database without its application, configuration or licence may not restore customer service.

Compare the wording, then the price

Use an identical scenario with each insurer and request clarification of restoration services, interruption waiting periods, extortion conditions and security declarations. Ask for the relevant clause and a written explanation of anything left uncertain. An optional extension should appear in the schedule, not merely in a sales discussion.

Reduce the exposure before transfer

A useful first action is to test restoration from separated backups and restrict privileged access. Assign an owner, a completion date and a simple test of whether the measure works. Written procedures matter only if staff can find and use them under pressure.

Evidence and the next review

Prepare restore-test records, backup architecture, administrator lists and recovery priorities. Date the records and keep an accessible copy away from the affected process. Keep offline access to the insurer contact, incident plan and supplier escalation list. A claim notification does not replace any required regulatory notification. Review the arrangement when your activity, technology, locations or counterparties change.