Backup Restore Testing for Singapore SMEs: The 3-2-1 Rule and the Restore Nobody Has Tried

A backup you have never restored is not a backup — it is a hope with a monthly invoice attached. The only way to know your data is recoverable is to perform a restore test: deliberately recover a file, a mailbox and a transactional dataset to a separate location, confirm the contents are correct and usable, and record how long it took. For a Singapore SME, that test should take under two hours, happen at least twice a year, and be run by someone other than the person who configured the backup. Everything below is the detail on how to do it, and what usually breaks the first time.

What does the 3-2-1 rule actually mean for a 15-person company?

The rule is old but it still holds: three copies of your data, on two different platforms or media, with one copy off-site and ideally offline or immutable. Translated into the stack a typical Singapore SME actually runs:

• Copy one — production. Google Workspace or Microsoft 365, your accounting SaaS, your POS, your HR and payroll system.
• Copy two — an independent backup of that production data, held by a different provider on a different login. For Workspace and 365 this means a third-party SaaS backup tool, not the platform's own trash and retention settings.
• Copy three — off-site and tamper-resistant: immutable object storage, or an external drive that is rotated and disconnected, holding monthly and year-end archives.

Two things that commonly get miscounted as copies. A Drive or OneDrive folder syncing to a laptop is a mirror, not a backup — a deletion or an encryption event propagates to it within minutes. And a RAID array in a NAS protects against one disk dying, not against fire, theft, ransomware, or an accountant overwriting the master price list. If all three of your copies live in the same office or under the same admin password, you have one copy with extra steps.

Why do backups that run fine every night still fail when you need them?

Five failure modes account for nearly every disappointing restore we have watched an SME attempt.

Scope drift. The backup was scoped in 2023 around the systems that existed then. Since then you added a shared drive for a new division, a second company file, a WhatsApp Business number, a website database. None of them were added to the job, and the job still reports success every night because it is backing up what it was told to.

Credential expiry. The backup connector authenticated as a staff member who has since left. The licence was reclaimed, the token died, and the tool has been emailing failures to a mailbox nobody reads. This is the quiet overlap between backup hygiene and access revocation — if your offboarding checklist does not ask "what automations authenticate as this person?", expect to find out here.

Short retention versus long detection. Platform retention windows are measured in weeks. Data damage is often discovered in months — a corrupted master record, a bad bulk import, a customer file quietly mangled in May and noticed in August. If your only recovery point is 30 days old, the clean version is already gone.

Backup of the symptom, not the system. Exported PDFs and CSVs are evidence, not a restorable system. Ask whether you can rebuild a working ledger, not just print last quarter's report.

No tested restore path. The data is genuinely there, but nobody knows the admin password to the backup console, the order in which systems must come back, or who at the vendor to call. Recovery becomes a four-day research project.

How do you run your first restore test without disrupting the business?

Block 90 minutes. Do it on a quiet morning, not during month-end close.

1. Pick three targets. One document from the finance shared drive. One mailbox or email thread, preferably from a departed staff member. One transactional dataset — a full day of POS sales, an accounting company file, or your website database.
2. Choose a restore point deliberately in the past. Forty-five days ago, not yesterday. Yesterday's copy proves almost nothing; the question is whether your recovery window is as deep as you assume.
3. Restore into a quarantine location. A separate folder, a test tenant, a staging database. Never restore over production during a test.
4. Open it and verify. Does the file open without errors? Do the invoice totals match what the system reported that day? Are attachments, formulas and linked images present, or just filenames?
5. Time two numbers. Minutes to the first usable file, and minutes to the full dataset. These are your real recovery times, and they are usually several times longer than the figure in the vendor's brochure.
6. Write down everything you could not restore. This list is the entire value of the exercise.
7. Fix the gaps, then re-test only the failed items within two weeks, while the context is fresh.

What should the restore-test record look like?

One page, filed where your management team can find it: date, who ran it, which systems were tested, the restore point used, measured time to recovery, pass or fail per item, gaps found, the named owner of each gap, and the date of the next test.

Keep it because it does double duty. Under the PDPA, you are expected to make reasonable security arrangements for personal data in your care and to be able to demonstrate accountability for them — a recoverable, tested backup is part of that posture rather than a nice-to-have. Separately, if you bid for government or large-enterprise work, security questionnaires and the CSA Cyber Essentials mark both ask about backup and recovery. A dated test record answers those questions with evidence. A policy document promising nightly backups answers them with intent, which is a materially weaker answer.

How often should you test, and who should own it?

Twice a year is the floor. Go quarterly if you process card payments, hold personal data at volume, or run an e-commerce database. Test again — out of cycle — after any migration, any new finance or HR system, any NAS replacement, and any change of IT vendor, because those are the moments scope silently drops.

Name a person and put it in the calendar with a recurring reminder, then make sure a second person can execute it alone. Rotate who runs it. If the only individual who can recover your business data is the owner or one long-serving staff member, you have not built resilience — you have built a dependency that happens to work most days.

What does this cost a small Singapore business?

Third-party backup for Workspace or Microsoft 365 typically runs in the low single-digit to high single-digit dollars per user per month. A few hundred gigabytes of immutable cloud storage sits in the tens of dollars a month. The test itself costs two hours of staff time, twice a year. If you are planning digitalisation spend for 2027, check the current Productivity Solutions Grant and SkillsFuture Workforce Development Grant listings before you buy — eligibility is specific to the supportable solution, so confirm rather than assume. Against that, price the alternative honestly: a fortnight rebuilding customer, pricing and accounting records from email and memory, during which you cannot invoice.

Frequently asked questions

Isn't Google Workspace or Microsoft 365 already backing up my data?

They provide redundancy and limited retention, which is not the same as backup. Deleted items and mailboxes are recoverable by an admin only within defined windows measured in weeks, and those windows shrink further once an item is purged or a licence is removed. Retention protects you from a bad afternoon. A backup protects you from a bad quarter.

Does the NAS in our office count as the off-site copy?

No. It fails the off-site test for the obvious physical reasons, and on most SME networks it also fails the offline test — if it is mapped as a writable drive on infected machines, ransomware reaches it too. Treat the NAS as copy two at best, and put copy three somewhere a compromised laptop cannot write to.

How long should an SME keep backups?

Separate operational recovery from statutory retention. For operations, keep at least 90 days of recovery points so you can reach back past slow-to-detect data damage. For records, accounting and tax documents in Singapore must generally be kept for five years, so hold year-end archives for that long on storage you have actually verified you can read.