Your backups: six questions to prepare a useful discussion.

Cybermalveillance.gouv.fr recommends, among other things, testing backups and protecting the copies. These checks need to be adapted to your environment and prepared so that they do not disrupt your business. Read the official best practice guidance.

Do not start with the name of the backup software. Choose an activity: processing an order, preparing a job or retrieving an administrative file. Ask the person responsible for it which information and tools they need.

The working document should describe this activity and the business owner who validates it. A technical team cannot decide on its own that a service is usable again for every scenario in the business.

Gather the documents available and ask what is explicitly covered. Also note recent changes: a new application, a new site, a moved folder or a new organisation.

Sort the answers into three groups: confirmed by available evidence, stated but to be checked, unknown. This distinction is more useful than a list of ticked boxes with no justification.

Identify the internal owner, the provider involved and the person authorised to approve an operation. Ask how these contacts would be reached if the usual tool were unavailable.

The meeting sheet should contain roles and controlled contact channels. It must not become a document holding passwords or technical secrets.

You do not need to simulate everything from the start. Choose a representative scenario with the relevant people, then define the question the exercise should answer.

For example, the team may want to check that it has the information needed to prepare a recovery. That does not authorise running a restore on a live system: operations and their conditions are a separate decision.

Before a test, have the criteria and the way they will be observed spelt out. Who validates the content? What report is expected? How will the points demonstrated be distinguished from the limits of the exercise?

A limited test should lead to a limited conclusion. It does not automatically prove that every scenario in the business is covered.

Turn each significant uncertainty into an action: a question to ask, a document to obtain or a check to prepare. Assign an owner and a deadline chosen by your team.

That way, you come away with a list of decisions, not just a reassuring or worrying impression. The technical scope can then be explored further with authorised specialists.

Priority activity and business owner. Information already available. Questions still open. Decision-maker and technical contacts. Scenario to prepare. Validation criteria. Next actions and owners.

This document remains an internal aid. It is neither a security certificate nor a complete disaster recovery plan. Skill Group can help you define the checks and next steps suited to your environment.