This isn’t the question “do you have backups?” It’s a different one. It’s Tuesday morning. Everything is encrypted, or simply unreachable. Email is down, the shared drive won’t open, and the database won’t load. And there are people expecting a service from you today. What happens? Most organizations find out the answer during the incident. Three things make that morning survivable. An untested backup is a belief, not a backup. The only way to know a backup works is to restore something from it. Do it this quarter. Restoring one folder is enough to learn whether the process works, how long it takes, and who knows how to do it. A few other things are worth checking while you’re there: Keep at least one copy separate from your everyday systems. Ransomware can encrypt backups that stay connected to the computers it reaches. Keep a copy somewhere other than the office. A fire or flood shouldn’t take the backup with it. Syncing isn’t the same as backing up. If your files sync to the cloud and someone deletes or encrypts them, the sync can faithfully copy that change everywhere. Check what your cloud services actually keep, and for how long. If it only exists inside the system that’s down, you don’t have it. Make a printed list of: Staff and board phone numbers Your insurance broker and the claims line Your bank’s fraud number Your IT provider Key client, partner and vendor contacts The incident plan itself The paper part sounds old-fashioned, and it’s the part people skip. It’s also the part that still works when nothing else does. Which two or three services absolutely have to continue? How would you run them for a week with a phone and a notebook? Who decides what gets paused? Making that call calmly now is far better than making it at 7 a.m. in the middle of a crisis. You don’t need a formal exercise to test any of this. Get your leadership team in a room for thirty minutes and talk through the Tuesday morning scenario. Who finds out first? Who do they call? Where is the phone list? What do clients hear, and from whom? The gaps show up quickly, and every one you find in a conversation is one you won’t find in a real incident. Print the contact list and the plan. Put one copy somewhere physical in the office, and a second copy somewhere that isn’t the office. Next in this section: the application is the audit.1. Backups you have actually restored
2. The things you need, on paper
3. A decision, made in advance, about minimum operations
Try it as a conversation
This week’s action
