Backed Up But Not Restorable? Who Actually Sets Your Recovery Clock

The office manager at a property management firm with two offices outside Austin had bought backup, paid for it monthly, and could name the vendor. On a Thursday in the middle of the month, the workstation that ran accounting stopped opening files, and by the time anyone called the IT contractor, the lease documents, the vendor invoices and the year's bank reconciliations were all sitting under an extension nobody recognized. She opened the sync folder on the second machine expecting relief. Every file was there, current to the minute, and every one of them was encrypted. The sync had done exactly what it was sold to do.

Four different things get sold under the same word

File sync keeps one folder identical across devices, which means it propagates damage as faithfully as it propagates work, and its usefulness in a ransomware event depends entirely on whether the provider retains prior file versions and for how long. Image-based local backup captures the whole machine, operating system and applications included, so a dead workstation can be rebuilt rather than reassembled. Managed cloud backup moves copies off site, past a fire or a stolen server. An offline or immutable copy, one that no credential on the network can alter or delete, is the only category that assumes the attacker already has your administrator password. Most small offices own the first and believe they own the fourth.

The distinctions matter less as categories than as answers to two questions: how far back can you go, and how long does getting back take. Version history that runs thirty days beats version history that runs seven, because ransomware frequently sits quiet before it fires. A local image restores fastest because the data is in the building. A cloud copy of four hundred gigabytes restores at the speed of your upload circuit's downstream, which is a number the firm outside Austin had never measured. An immutable copy costs a little more and answers the only scenario in which the other three fail at once.

The restore test is the only comparison that reports back

A backup that has never been restored is a receipt, not a copy. The test that settles the question is unglamorous: take a spare machine, restore the accounting file and the shared drive from the backup you actually pay for, open the file, and reconcile one month against a bank statement you already have. Time the whole thing with a clock. Firms that run this discover the specific, boring failures that no dashboard reports, an excluded folder, a database that was open and therefore copied mid-write, a license key that lives only on the dead machine, a credential held by a technician who left.

Run the test twice a year and the numbers stop being theoretical. You learn that your recovery point is eleven hours, not one, because the job runs overnight and the day's work is not captured. You learn that recovery takes two business days rather than the afternoon everyone assumed, because the restore has to finish before anyone can verify it. Those two numbers, hours of work lost and days of office closure, are what you are actually buying when you compare backup products, and they are the only terms in which the comparison can be honestly made.

The people next to the decision, and which of them is choosing

The office manager thought she had chosen the backup. In practice her retention window was set by a default in the managed service provider's standard package, her exclusion list was set by a technician who built the job in an afternoon three years earlier, and her restore priority was set by a contract clause promising response within a business day rather than resolution within any period at all. The bookkeeper, who was never consulted, is the person who knows which four files would make the difference between a bad week and a lost quarter. That knowledge lives one desk away from the purchase and rarely travels.

Two more parties hold pieces of the decision. The cyber insurer sets conditions through the application: answers about offline copies, multifactor authentication and testing frequency become representations the carrier can measure a claim against, and the policy will usually require you to use its panel forensic firm and its panel counsel rather than your own IT contractor. The Federal Trade Commission is responsible for data security enforcement across large parts of the private economy, and for certain businesses, tax preparers and auto dealers among them, it imposes written safeguards obligations that make the testing schedule a documented duty rather than a good habit. Ask for the test report. Someone is producing one, or nobody is.

Your notification clock is set by where your tenants live

The firm's servers sat in Texas, its offices sat in Texas, and its obligations did not. State breach notification statutes attach to the residency of the affected individuals, so a tenant roster with people who moved to Colorado, Florida or Maine brings those states' rules into the matter regardless of where the data was stored. The outer deadlines differ meaningfully: some states set a fixed period measured in days from discovery, others require notice without unreasonable delay, and several add a separate duty to notify the state attorney general or the consumer reporting agencies once the count of affected residents crosses a threshold written into that state's law.

This is where a restore speed stops being an IT metric. If your records are unreadable, you cannot determine who was affected, and the clock is running while you find out. Firms that can restore a readable copy in a day can scope the incident and notify inside the tightest applicable window. Firms that cannot are writing letters based on assumptions. Retention rules pull the same direction: state real estate commissions, medical boards and licensing agencies each specify how long records must be kept and produced on request, and those periods vary by state and by profession, which makes a seven-day version history quietly noncompliant in places.

Putting the test in someone's job description

The fix at the Austin firm was cheap relative to the week it lost. The managed service provider added an immutable cloud copy with a ninety-day retention window, the bookkeeper wrote a one-page list of what has to come back first and in what order, and the office manager put a semiannual restore drill on the calendar with her own name against it rather than the vendor's. The drill produces a dated page recording what was restored, how long it took and who verified it. That page is what the insurer's adjuster asks for, and what counsel needs on day two of a notification analysis.

Ownership is the part that transfers badly. Vendors test their infrastructure, not your ability to work from what they hold, and the gap between those two things is where the surprise lives. Naming a person, giving them a clock and a spare machine, and letting them find the excluded folder on a quiet Tuesday turns the entire question from a purchase into a measurement.