By Heath Gieson, CISO / EVP of Operations, Forthright

Let’s be honest—no one ever needs a backup… until they do.

Backups are one of those things we all know we should have, and most of us do. But here’s the truth: backups don’t matter if you can’t restore. We often get so caught up in the process of backing up data—schedules, storage, retention policies—that we forget the real reason we do it: to restore.

This week, as we wrap up our Cyber Security Action Month series, we’re focusing on the action behind the backup: restoration.

Why Restores Deserve More Attention

When disaster strikes—whether it’s ransomware, accidental deletion, or hardware failure—the ability to restore data quickly and completely is what keeps your business running. But how confident are you that your backups are actually restorable? That they contain the right data? That they’ll be available when you need them?

Let’s break it down.

Your Action Item This Week: Test Your Restore Strategy

Here are the key questions every organization should be asking:

Is the Right Data Available for Restore?

• Are you backing up the systems and data that matter most?
• Are critical business applications, databases, and user files included?
• Are you backing up cloud-based data (e.g., Microsoft 365, Google Workspace, SaaS platforms) or just on-prem systems?

A backup is only as good as its scope. If you’re not backing up the right data, you’re not protected.

What’s Your Recovery Time Objective (RTO)?

• RTO is the maximum amount of time your business can function without a specific data set or system.
• Ask yourself: If this system went down right now, how long could we operate without it?

This helps prioritize which systems need faster recovery and which can tolerate longer downtimes.

What’s Your Recovery Point Objective (RPO)?

• RPO is the maximum amount of data your business can afford to lose.
• Ask: If we had to restore from a backup, how far back could we go without major disruption?

If your RPO is 24 hours, but your backups only run weekly, you’ve got a problem.

Have You Tested a Restore Recently?

• When was the last time you actually performed a test restore?
• Did it work? Was the data intact? How long did it take?

Testing your restore process is the only way to know if your backups are truly reliable.

At Forthright, we like to say: “Backups are for peace of mind. Restores are for survival.” Don’t wait for a crisis to find out your backups aren’t doing what you thought they were.

Wrapping Up—But Not Slowing Down

As we close out Cyber Security Action Month, remember this: just because the month is over doesn’t mean the work is done. Cybersecurity is a continuous journey, not a one-time campaign.

Stay tuned for our next series, where we’ll continue to share insightful, actionable tips to help you stay vigilant and secure your organization—one step at a time.