Security check

Backup evidence: prove you can restore, not just that you copy

A backup that's never been tested is a hope, not a control. We help you document that backups cover the right data, are tested regularly and protected against deletion — the evidence auditors and NIS2 ask for.

Run a free domain scan All checks →
Relates to: NIS2 · art. 21 — business continuity & backup ISO 27001 · A.8.13 information backup SOC 2 · A1.2 / CC9.1 DORA · continuity (context — mapping on roadmap)

What we check

We walk your backup control as an evidence chain: which systems and data are covered, how often copies are taken, whether restore is actually tested, and whether copies are immutable/offsite so they survive ransomware and accidental deletion.

Why it matters

Backup is one of the controls where the gap between 'we have it' and 'we can prove it' is largest. NIS2 and DORA require continuity, and an auditor won't accept a backup routine never verified with a real restore.

How Security Guru tests it

Common mistakes

  • Backup that runs but is never test-restored — unknown if it's even readable
  • Copies on the same account/key as production — ransomware reaches both
  • No defined RPO/RTO to measure the routine against
  • Critical systems (databases, secrets) outside the backup scope

What you get in the report

  • Backup coverage per critical system — green/red
  • Status of test restores and the last verification
  • Deletion/ransomware protection and identified gaps
  • Ready evidence mapped to NIS2 / ISO A.8.13 / SOC 2 (supports DORA continuity)

FAQ

Do you take over our backups?

No — we help you document and verify your existing routines and close the gaps. You own the operation.

What are RPO and RTO?

RPO = how much data you can afford to lose (how old the latest copy may be), RTO = how fast you must be back up. The routine should be measured against both.

Is having copies enough?

No — the requirement is proven restorability. A copy never tested doesn't count as a working control.

Want to know your status?

Run a free scan or order a full Security Assessment — prioritised, not noise.

Run a free domain scan