Skip to main content

Technology teams

A backupyou haven't restoredis a guess.

Test the restore, time it and write it down. Then you know how fast the school day comes back.

  • 2-minute lesson
  • Free · no sign-in

  1. 1Why it matters

    The restore-test runbook

    Two rhythms cover most districts. Quarterly: a file-level restore from one important system, rotating the system each quarter. Once a year: a full-system or bare-metal restore of one critical server into an isolated environment, timed from start to finish. CISA's Cybersecurity Performance Goals call for testing backups and recovery at least once a year; quarterly file tests catch silent failures sooner.

    • Step 1 — Schedule it. Put the test on the team calendar, outside testing windows and payroll weeks.
    • Step 2 — Pick the target and the set. Choose the system and use the newest backup set, not the one you expect to work.
    • Step 3 — Restore to an isolated place. Use a test network or alternate folder, never over live production data.
    • Step 4 — Start the clock. Record the start time to the minute.
    • Step 5 — Restore and open. Open real files: a spreadsheet from the business office, a PDF from special education, a config file you can read.
    • Step 6 — Ask the data owner. Have a business office or school user confirm the restored files are the ones they would need.
    • Step 7 — Stop the clock. Record the end time and compare it with the recovery time objective.
    • Step 8 — Check the age of the data. Compare the newest restored file time with the recovery point objective.
    • Step 9 — Check the alerts. Confirm backup failure alerts reach a team mailbox, not one person's inbox.
    • Step 10 — Clean up and record. Remove the test copy and complete the one-page evidence record the same day.

  2. 2Do this

    • Keep an offline copy

      3-2-1 with one offline or immutable copy and backup sign-ins kept apart from the everyday domain.

    • Time the restore

      Quarterly file-level and yearly full-system tests, timed start to finish against your recovery targets.

    • Write one page

      Date, system, backup set, restore time, data age and fixes. Failed tests count as evidence too.

    Back up
    • SIS exports
    • Finance & payroll
    • File shares
    • Identity systems
    • Network configs

    Test failed? Good: the program worked. Preserve the logs, rule out tampering, fix the gap and record it honestly.

  3. 3Quick check

    Which test cadence fits a small district team and current CISA goals?
    Scenario: During the quarterly test, last night's backup set will not mount. The set from ten days ago restores fine, and the quarterly report is due Friday. What should the evidence record say?

    Choose an answer for each question.

Want credit for this?

Sign in to Cyber Academy to take the full course, record your progress and earn a completion certificate.

Full course: Backups you can actually restore · 18 min

Sign in for credit
Sources

We count visits to this page in aggregate only. No cookies, no accounts, no personal data.