Insights · Field note · Infrastructure and resilience
Backup validation: proving restores, not backups
Every backup job succeeded last night. That proves a copy was written. It proves nothing about whether the business can come back.
Backup validation is the regular, documented restoration of data and services from backup copies to confirm they are complete, usable and recoverable within the time the business requires, from storage an attacker with administrative access cannot reach. A successful backup job proves a copy was written. Validation proves the copy restores, that the application comes up, that dependencies restore in the right order, that the time is known, and that the copies are isolated. Insurers and auditors ask whether backups are tested; job reports do not answer, restore records do.
In detail
What the evidence shows.
What a job report does not show
Whether the data was complete. Whether it restores. Whether the application starts from it. Whether the restore takes two hours or two days. Whether the copies are reachable with the same credentials as production. Every one of these is discovered during a real recovery unless it was discovered during a test.
What validation does
Restores sample files and checks integrity. Restores a complete application or service into an isolated environment, with its dependencies, and times it. Compares the result with the recovery objectives. Confirms the copies are immutable or offline with separate credentials. Records all of it with dates and sign-off.
Isolation is part of validation
Ransomware operators delete or encrypt backups they can reach. CISA’s guidance emphasizes offline, encrypted and tested backups for this reason. Validation includes confirming that a production administrator cannot delete the copies, because if they can, so can an attacker holding their credentials.
Cadence and evidence
File restores frequently; service restores on a schedule and after changes to backup systems or critical applications; failures recorded as faithfully as successes. The backup and restore validation checklist covers each step; see backup and restore validation and backup versus recovery readiness.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days