Backup Restore Test for Singapore SMEs: Prove You Can Recover Before December

Test the restore, not the backup. For a ten-person Singapore company, that means picking the three things you could not trade without - usually the accounting file, the shared drive and email - then actually rebuilding them onto a spare laptop, timing how long it takes, and checking the data is complete to the last working day. If nobody has done that in the past six months, you do not have a backup. You have a hope. Blocking out half a day in late October to prove it is the cheapest insurance in the business.

Why does a backup that exists still fail when you need it?

Backups fail quietly, and almost always in one of five ways. The job has been erroring for months and the alert email goes to a staff member who left. The backup covers the laptop but not the cloud accounting system, or the cloud system but not the one spreadsheet finance actually runs on. The only copy sits on a drive plugged into the same office network, so ransomware encrypts it along with everything else. Nobody knows the password to the backup account. Or the restore works perfectly and takes eleven days, which for an order-taking business is the same as not working.

None of these show up on a dashboard with a green tick. They only show up on the morning you need the data, which is the worst possible time to discover them.

What does a proper restore test look like for a 10-person company?

Keep it small and real. Write down your three most critical systems, then restore one file or mailbox from each onto a device that is not the original, and compare it against what you know to be true.

• Accounting: restore last month's data and check the closing bank balance matches the statement. A restore that opens but shows the wrong balance has failed.
• Shared files: recover a folder that was deleted or changed in the past week. This tests version history, not just existence.
• Email: restore one mailbox, including sent items, and confirm attachments open.
• The quiet one: whatever lives only on one person's machine. Every small company has at least one, and it is usually the pricing sheet or the quotation template.

Time each step with a stopwatch and note who did it. The timing is the whole point. Most owners assume recovery is a two-hour job and find it is two days, mostly spent hunting for logins.

How much downtime and lost work can the business actually absorb?

Two numbers decide what you should spend. The first is how long you can be down before it costs you real money - for a service firm that may be two days, for a business taking daily orders it may be two hours. The second is how much recent work you can afford to re-enter by hand. A backup that runs nightly means you can lose a full day of invoices and bookings, which for a busy December can be a hundred transactions nobody remembers.

Write both numbers down in plain language. "We can be offline one working day and re-key half a day of orders." Then check whether your current setup can meet them. If it cannot, you either accept the gap in writing or pay to close it. Both are legitimate decisions. Pretending the gap is not there is not.

What does ransomware recovery really involve for a small team?

Ransomware does not just encrypt files. It takes out the shared drive, often the accounting system if it is mapped as a drive, and sometimes the backup itself - attackers look for backups first because that is what forces payment. Recovery for a small team means working from a clean machine, resetting every password, and restoring from a copy the attacker could not reach.

That last point is the one worth money. Keep at least one copy that is offline or immutable, meaning it cannot be altered or deleted even by someone holding your admin password. Cloud file sync alone is not this. Sync faithfully copies encrypted files over your good ones. The long-standing rule still holds: three copies of your data, on two different types of storage, one of them off-site and out of reach.

On paying a ransom: Singapore's cyber security authorities advise against it, and the practical reason is simple. Payment buys a decryption key from a criminal, not a working business, and it marks you as a company that pays.

What are the legal obligations if customer data is caught up in it?

Under the PDPA, a data breach that is likely to cause significant harm, or affects 500 or more individuals, must be reported to the Personal Data Protection Commission within three calendar days of you assessing it as notifiable. Affected individuals must be told as well. Ransomware involving staff, customer or CV records is firmly in scope, and the three-day clock is short enough that a team improvising will miss it.

Separately, your tax and accounting records must be kept for five years. If your only copy of 2022 invoices was on the encrypted server, a ransomware incident becomes a compliance problem on top of an operational one. A police report and notification to SingCERT are both sensible and cost nothing.

Who runs the recovery while the owner is on leave in December?

This is where most small firms are exposed. The person who knows the backup passwords is usually the owner, and December is exactly when they are away. Before the holidays, make sure a second trusted person holds emergency access to the backup account, the domain and email admin, and the accounting system - stored in a password manager with an agreed break-glass process, not in a notebook or a WhatsApp message.

Then write one page: who to call, in what order, which systems matter most, and the two recovery numbers you agreed. One page that a covering staff member can follow beats a detailed plan only the owner understands.

Frequently asked questions

How often should a small company test a restore?

Twice a year is enough for most ten-person firms, with one of those tests before the year-end close. Also retest after any change to your systems - new accounting software, a new server, a staff departure that moved admin access.

Is Microsoft 365 or Google Workspace already a backup?

No. Both are excellent at keeping your files available, but deleted items and file versions expire after a set period, typically 30 to 93 days, and neither protects you from a staff member or attacker deleting content with valid credentials. Treat them as live storage that needs its own backup.

What does an adequate setup cost for ten staff?

Cloud backup for a team this size is usually a modest monthly subscription per user, in the range of a few dollars each, plus a one-off day of configuration. The expensive part is not the tool. It is the time to test it properly, and that is the part people skip.

Where to start: block two hours this week, restore one file from each of your three critical systems, and write down how long it took and who could do it without you. Whatever that exercise reveals is your December priority list.