Most backup arrangements have never been used. The failure modes that emerge only on the day you need them, why the encryption question is sharper here than anywhere else, and a test that takes an hour and settles it.
Copying is not the hard part
All the attention goes on getting data out, which is the easy half and the half that reports success.
The event being prepared for is the other one: getting it back, in a hurry, possibly onto hardware you have never used, possibly without the machine that held the credentials, and almost certainly while something else is also going wrong.
A backup that has never been restored is a hypothesis with a schedule attached.
Failures that only appear on restore
Each of these is ordinary rather than exotic.
The backup succeeded and excluded a directory, because a path changed months ago and nothing compares the contents against what you believe is covered.
It has been failing for months and the notification goes to an address nobody reads, so the last good copy predates the problem you are trying to undo.
The archive is fine and the passphrase lived on the machine that died.
The restore needs software, or a specific version of it, that is no longer available — the data survived and the means of reading it did not.
And the copy sits on a drive that has been plugged in continuously, which malware treats as just another folder to encrypt, because to the operating system that is exactly what it is.
The rule people know and do not follow
Three copies, on two kinds of media, with one somewhere else.
The second copy covers deletion and corruption. The second kind of media covers a defect common to the first — a controller, a format, a batch. The offsite one covers everything that destroys a room.
The clause everybody skips is the last, and it is the only one addressing the failures that take all copies at once: fire, theft, and encryption by something that reached every attached volume. Two copies eighteen inches apart is one copy with extra steps.
The encryption question is sharper here
Sharper in both directions, which is why it is worth stating rather than resolving cheaply.
A backup is the single richest target that exists — everything you have, organised, deduplicated and indexed for retrieval. If the provider can read it, then so can whoever compromises the provider, and so can anyone who can compel them.
But encrypt it yourself and the key becomes a thing that must survive the disaster. Which is the part almost nobody plans, because planning it means imagining the bad day in enough detail to notice where the key was sitting.
Where the key must live
Not only on the machine being backed up. That is the circular dependency, and it is the most common one.
Not only in a password manager whose own recovery runs through an account on that machine, which is the same circle drawn more carefully.
Printed and physically stored is unfashionable, immune to every digital failure mode, and works. A safe, a deposit box, a sealed envelope somewhere sensible.
A second copy held by somebody you trust is a genuine option with a genuine cost. It is worth considering properly rather than dismissing on instinct, because the alternative failure is total.
The test
An hour, once, and it settles everything.
Choose a file from several months ago — not yesterday's, since yesterday's proves only that yesterday worked. Restore it onto different hardware. Open it. Time the whole thing from start to finish.
Each part answers something. Restoring an old file tests whether coverage is real rather than recent. Different hardware tests whether the credentials and the software exist outside the original machine. And the timing produces the number every plan silently assumes and almost nobody has measured — how long you would actually be down.
In an organisation, add one condition: have it done by somebody other than the person who set it up. That tests the documentation, which is otherwise being stored in one person's head alongside their holiday plans.
If it takes three days, that is not a backup failure. It is a fact about your plan that you now know on a calm day rather than a bad one.
Why the hour never gets spent
The incentives are honest about themselves, which is worth stating plainly rather than treating the omission as carelessness.
The test costs an hour. It is scheduled against work with visible value and somebody waiting for it. And when you skip it, nothing happens.
The pressure to skip is present every single time. The cost of having skipped arrives once, later, and often to a different set of people. That is the same arithmetic that makes anyone postpone a small certain cost against a large unlikely one, and there is nothing unusual about getting it wrong.
Naming the shape is most of the fix, because the decision then has to be made out loud.
Close
Do the restore once. Then you have a backup. Until then you have copies, and a belief about what they would do.