Every team believes they have backups. The belief usually rests on a setting someone enabled two years ago and an assumption that AWS handles the rest. Here's a test you can run in ten minutes, in a meeting, with no tooling. Pick your single most important system and answer five questions out loud.
The five questions
- Where, exactly, is the backup? Name the service and the location. "RDS does it automatically" is a partial answer; automated snapshots live in the same account and region as the database they protect.
- When did the last one succeed? Not "it runs nightly". When did it last succeed, and would anyone be alerted if it stopped?
- Who can perform a restore? A name, not a team. If the name is the person currently on leave, write that down too.
- How long would a full restore take? A number, in hours. If nobody knows, the honest answer is "we'd find out during the outage".
- Could an attacker with your admin keys delete it? If backups live in the same account with the same credentials, ransomware that owns your account owns your backups too. That's not a backup. That's a copy.
Scoring
Five confident answers: genuinely rare, well done. Three or four: normal, fixable, and worth an afternoon soon. Fewer than three: you don't have backups, you have hope, and I'd treat it with the urgency of a production incident that hasn't happened yet.
What good looks like
Agreed recovery targets in plain english (how much data loss is tolerable, how long an outage is survivable). Backups copied somewhere your day-to-day credentials can't touch. Monitoring on the backup jobs themselves. A written runbook. And above all, a restore you have actually performed, timed, at least once. Untested backups fail at a rate that surprises everyone the first time they run a drill.
Didn't love your score? The Backup & DR service ends with a live, timed restore of your most important system. Get in touch.