How Often Should a Community Bank Test Backup Restores, and What Proof Should It Keep?

A community bank should restore-test its backups on a fixed schedule and keep proof of every test, not just confirm that backup jobs completed. At Tomorrow's Technology Today, we run a full restore test on every protected server and critical workstation every other week. That's 26 restore tests per system per year, each with a screenshot captured as proof.

Here's why the schedule matters, how a backup should be verified, and what evidence your bank should keep on file.

1. Why "Backup Completed" Isn't Proof

A backup job that finishes successfully only proves the job ran. It doesn't prove the data can come back. The only way to know is to restore it.

"Your data is backed up" is the phrase to watch for. The answer you want is: "Every backup is fully restored every other week, and the login screen is captured as proof."

It also helps to know exactly what gets backed up and why:

• Servers are backed up and restore-tested.
• Workstations are backed up only if they run critical programs, and those backups are restore-tested too.
• Files in Microsoft 365 are backed up separately through a third-party cloud backup service, so ordinary workstations don't need their own backup.

2. The 4-Layer Backup Verification Framework

1. Daily review. An engineer checks backup status every business morning. The bank receives a daily backup status report too.
2. Failure escalation. Every failure becomes a ticket. Two failures in a row trigger an escalated investigation with the backup vendor.
3. Independent cross-check. A separate monitoring system confirms backup status and flags any system that's added to or removed from backups.
4. Full restore test. Every other week, each protected system is fully restored and the result is captured as proof. A failed test is retried on the next cycle, then escalated.

Most providers stop at layer 1. For the backup questions to ask any provider, see What Should a Community Bank Look for When Choosing a Managed IT Provider?

3. What Proof to Keep for Examiners and Auditors

• Restore test records, with the screenshot captured from each test
• The daily backup status report
• Escalation tickets showing how each failure was handled and resolved
• The retention policy: recovery points captured twice a day and kept for 90 days, then a monthly recovery point kept indefinitely
• Confirmation that backups are immutable, meaning they can't be altered or deleted, including by ransomware

Build that record throughout the year rather than assembling it before an exam. See What IT and Cybersecurity Reports Should a Community Bank Maintain for Examiners and Auditors?

4. 6 Questions to Ask Your IT Provider About Backups

1. How often are backups restore-tested?
2. Is each test a full restore, or only a file-level check?
3. What proof do we receive from each test?
4. Who reviews backup alerts each day?
5. When does a failed backup get escalated?
6. How long is each recovery point kept?

5. What a Restore Test Doesn't Prove

A restore test proves your data can come back. A disaster recovery test proves your bank can keep operating while it does. Those are different questions. We offer tabletop exercises as a separate engagement after onboarding.

There's also one limit we tell clients about up front: our backup platform can't protect SharePoint files after they're marked "archived" in SharePoint. We'd rather you hear that from us before it matters.

A Real Example: Restored Before Monday Morning

This example is from a manufacturing client, not a bank, but the process is the same.

The problem: Over a weekend, a client's virtual server showed intrusive activity.

What we did: The Security Operations Center locked the server down, and our team restored it from backup.

The result: The server was back within 48 hours, before employees arrived Monday.

Why Banks Work With Tomorrow's Technology Today

• 26 full restore tests per protected system each year, with proof captured
• Immutable backups as standard
• Daily review by an engineer, plus independent monitoring
• Serving community banks since 2011
• Every technician, and our founder, is background-checked and CJIS security-trained

From our home base in St. Henry, Ohio, we support community banks across west-central and Northwest Ohio, including Lima, Sidney, and Dayton, and serve businesses throughout Northeast Indiana, including Fort Wayne and Richmond. Learn more on our community bank IT services page.

Frequently Asked Questions

How often should a community bank test its backup restores?

Answer: On a fixed, documented schedule. Tomorrow's Technology Today runs a full restore test on every protected server and critical workstation every other week, which is 26 tests per system per year, with a screenshot captured as proof.

What backup proof should a bank keep for examiners?

Answer: Restore test records with screenshots, the daily backup status report, escalation tickets for failures, the retention policy, and confirmation that backups are immutable.

Does every workstation need to be backed up?

Answer: Not usually. Tomorrow's Technology Today backs up workstations that run critical programs. Files in Microsoft 365 are backed up separately through a third-party cloud backup service.

Is a restore test the same as a disaster recovery test?

Answer: No. A restore test proves data can be recovered. A disaster recovery or tabletop exercise tests whether the bank can keep operating during an outage.

Want to know when your bank's backups were last restore-tested? Call 419-678-2083 and we'll help you find out.