Storm Season Is Coming: Test Your Backups Before the First Power Outage

11 minutes ago

7 min read

Every fall we have the same conversation with a handful of Rochester and Buffalo business owners, and it always starts the same way: the power blinked, the server didn't come back, and now somebody is asking a very uncomfortable question about backups. Here's how to make sure that question has a good answer before the first real storm of the season.

Why September Is the Right Time to Look at This

The first serious wind advisory of the season usually shows up in Rochester somewhere between late September and the middle of October. Leaves are still on the trees, the ground is soft from a wet week, and a gust line comes through off the lake and takes a few thousand RG&E customers offline for the afternoon. Nobody calls that a disaster. It is just fall in Western New York.

It is also the single most common way small businesses around here discover that their backups were not doing what they thought they were doing.

The pattern is almost boring in how consistent it is. Power flickers twice, comes back, and the server in the closet does not come back with it. Or it does come back, but the line-of-business database it hosts has an inconsistent file and will not mount. Somebody goes looking for the backup, and it turns out the last good copy is from eleven weeks ago, because a drive filled up in July and the job has been quietly failing ever since. There was even an alert about it. It went to an email address belonging to a person who left the company.

That is the whole story. Not a nation-state hacker. A full disk, a stale notification, and a windy Tuesday.

The good news is that this is a fixable problem, and September is the right month to fix it, because you have a few weeks before the weather gets genuinely mean and because most businesses are already in planning mode for the fourth quarter. Here is how we walk clients through it at CETech.

A Backup You Have Not Restored Is Not a Backup

This is the part that catches people off guard. Most of the businesses we meet do have something running. There is a backup appliance, or an agent on the server, or a cloud sync somewhere, and the dashboard says green. What is usually missing is proof that the thing in the backup can actually come back to life.

A backup is a file. A recovery is an outcome. They are not the same, and only one of them saves your week.

So the first question we ask is not "do you have backups." It is "when did somebody last restore something from them, and how long did it take." If the answer is a shrug, that is your project for the next two weeks.

A real test does not have to be dramatic. Pick a shared folder, delete a file into the recycle bin on purpose, and have somebody restore it from yesterday's backup while you watch the clock. Then pick something harder. Restore a full copy of a virtual machine into an isolated space and see if it boots, if the application starts, and if the data inside it is current. Write down how long each step took. That number, not the green checkmark, is your actual recovery time.

Know Your Two Numbers Before the Storm, Not After

Every business continuity conversation eventually lands on two numbers, and they are worth putting on paper in plain English before you spend a dollar on hardware.

The first is how much data you can afford to lose. If your backup runs nightly at 11 p.m. and the server dies at 4 p.m., you have lost a full day of work. For a machine shop tracking job progress, that might be genuinely survivable. For a practice entering charges and appointments all day, it is a nightmare of re-keying that will cost you more in staff hours than the backup system costs in a year.

The second is how long you can afford to be down. Not how long you would like to be down. How long before customers start calling, before crews sit idle, before a compliance obligation gets missed. An hour is a very different engineering problem than a day, and a day is a very different problem than a week.

Once those two numbers exist, the technology conversation gets simple, and honestly cheaper. Most overspending on backup happens because nobody defined the target, so somebody bought protection for the worst imaginable case across every system in the building. Most underspending happens for the same reason.

The Rule Worth Remembering: Three, Two, One

The framework has been around for years and it still holds up. Three copies of your data. Two different kinds of storage. One copy off site.

The off-site copy is the one that matters most in a power event, a fire, a burst pipe, or a ransomware incident, and it is the one most often missing. A USB drive sitting on top of the server it protects is not a second location. Neither is a NAS in the same closet on the same circuit.

The modern addition worth making is immutability. Ransomware crews have gotten methodical about hunting for backup systems first, encrypting or deleting the recovery points, and only then triggering the payload, because a company that cannot restore is a company that pays. An immutable copy is one that cannot be altered or deleted for a set retention window, even by an administrator account. If your current setup does not have something like that, it is the highest-value upgrade on the list.

Cloud Data Needs Backup Too

This one surprises people every time. If your email, files, and documents live in Microsoft 365, you are not automatically backed up. Microsoft keeps your service running and protects their infrastructure. They are not responsible for the fact that somebody emptied a mailbox in March, or that a departing employee deleted a SharePoint library, or that a phishing compromise wiped a folder tree.

Retention policies help, and they expire. If a business-critical record needs to exist three years from now, it needs a real backup with a real retention setting, separate from the platform it lives in. Same story for cloud accounting, CRM, and anything else running your business that you do not host.

Power, Batteries, and the Boring Physical Stuff

The unglamorous half of storm readiness is electrical. A few things worth checking before October:

Test the battery backups. UPS batteries wear out on a three-to-five-year cycle, and a dead battery looks exactly like a working one until the lights go out. Most units have a self-test. Run it.

Check what is actually plugged into the UPS. It is remarkably common to find a monitor on battery power and the switch that connects the whole office to the internet on an unprotected strip.

Confirm that equipment shuts down gracefully. A server that runs the battery to zero and drops hard is how you get corrupted databases. Automatic graceful shutdown at a low battery threshold prevents most of that damage.

Know where the alerts go. Every monitoring notification should reach a person who still works there and a team that watches around the clock. This is the single cheapest fix on the entire list and it is wrong at a shocking number of businesses.

Write Down the Plan, Including the Phone Numbers

When the power is out and the internet is down, nobody remembers where anything is documented, because the documentation is often on the system that just went offline.

Keep a printed page. Who to call at CETech, who to call at the internet provider, the account numbers, which systems come up in which order, which vendor holds the license keys, and who tells staff and customers what is happening. One page, in a binder, in a drawer, plus a copy on somebody's phone.

Then have an answer for the awkward part: if the office is dark for two days, where do people work and how do they connect. For a lot of businesses the honest answer after the last few years is "from home, and it is fine." For others it involves a phone system reroute and a couple of decisions that are far easier to make in September than at 6 a.m. on a Thursday in December.

What This Looks Like When It Is Handled

Here is the version we want for every client. Backups run continuously to local and off-site storage, with an immutable retention window. Restore tests happen on a schedule, not on a hope, and results are documented. Recovery time and data-loss targets are written down and agreed on, and the technology matches them. Alerts land with a team that is watching. And when the power drops on a wet Wednesday in October, the plan is a boring checklist rather than a scramble.

None of that requires a big internal IT department. It requires somebody owning it and testing it on a calendar.

Let's Check Yours Before the Weather Turns

CETech has been keeping technology running for Rochester and Buffalo businesses for over twenty years, across manufacturing, engineering, construction, trucking, property management, and healthcare practices. Backup and recovery is one of the first things we look at with a new client, because it is the one area where the gap between "we think we're covered" and "we are covered" tends to be widest.

If you are not certain when your backups were last restored, or where your off-site copy lives, or who gets the alert when a job fails, that is worth an hour of conversation this month.

Give us a call at 585-441-0055, email info@cetechno.com, or reach out through cetechno.com to schedule a look at your backup and recovery setup. Better to find the gaps now, while the weather is still on your side.