Coverage
Confirm which information, users, devices, applications and locations are protected, retained or excluded.
Independent recovery assurance
Backup & Recovery Validation for Ontario small businesses.
Backups matter only when the right information can be restored by authorized people within a timeframe the business can tolerate. CyberTECT independently reviews coverage, recovery responsibilities and selected restore paths so owners can see what is proven, what is assumed and what still depends on one person or provider.
Why validation matters
A successful backup report does not prove the business can recover.
Backup systems can report that copies were created while important mailboxes, SharePoint sites, local files, applications or vendor-hosted records remain outside the policy. Recovery validation follows the complete path from business information to usable restoration, including access, authorization, timing and provider involvement.
Authority
Identify who can request, approve and complete recovery when the usual administrator or provider is unavailable.
Recoverability
Validate a selected recovery path and record whether the restored information is accessible, complete and usable.
Canadian business context
Recovery costs are real, but the practical question is whether the organization is prepared.
Statistics Canada’s 2023 survey covers businesses with 10 or more employees across most economic sectors. These figures provide national context and are not a prediction of what will happen to an individual organization.
of Canadian businesses reported being impacted by cyber security incidents in 2023.
was spent by Canadian businesses recovering from cyber security incidents in 2023, double the 2021 total.
of impacted businesses reported ransomware attacks in 2023.
What CyberTECT validates
Recovery depends on data, systems, people and providers working as one chain.
The scope is matched to the organization. It can include Microsoft 365, local devices, servers, websites, accounting records, practice-management systems and other critical services identified during the validation.
Critical information
Exchange email, OneDrive, SharePoint, local files, accounting records, websites and agreed line-of-business data.
Backup policy scope
Schedules, protected users and sites, retention periods, storage locations, exclusions and policy changes.
Recovery objectives
How much recent data loss is tolerable, how quickly priority work must resume and which systems come first.
Access & authorization
Administrator roles, recovery permissions, approval requirements, credentials and alternate authorized contacts.
Provider responsibilities
What the business, IT provider, cloud platform and backup supplier each operate, monitor and support.
Backup protection
Separation, restricted access, encryption, offline or isolated copies and protection against deletion or alteration.
Microsoft 365 recovery
Service resilience, retention and dedicated backup solve different parts of the problem.
Microsoft 365 is designed with substantial platform resilience and geographic redundancy. Organizations still need to decide whether dedicated backup is required, which Exchange accounts, SharePoint sites and OneDrive accounts are protected, who controls recovery and whether the restore workflow supports business needs.
- Review which users, sites and services are included in backup policies.
- Separate records-retention decisions from operational recovery requirements.
- Confirm recovery points, restore options and administrative permissions.
- Document the customer, Microsoft partner and provider responsibilities.
Three related controls
Not interchangeable1Service resiliencePlatform availability and redundancy operated by Microsoft.Platform
2RetentionRules that preserve or delete information for business, records or legal purposes.Policy
3Backup & restoreSeparately managed recovery points and workflows for protected data.Recover
Controlled validation
Test a defined recovery path without creating unnecessary disruption.
The validation method is chosen around the system, business impact and available permissions. Some engagements use a selected file, folder, mailbox or alternate-location restore. Higher-impact tests require additional planning and provider coordination.
- Agree on the data, system and expected recovery result.
- Confirm authorization, destination and provider involvement.
- Perform the selected restore and verify usability.
- Record timing, limitations, unresolved dependencies and corrective actions.
Validation sequence
Evidence before confidence1InventoryIdentify priority data, systems, owners and dependencies.Map
2Confirm coverageReview policy scope, exclusions, monitoring and responsibility.Verify
3RestoreRecover representative information through the approved path.Test
4Retain evidenceDocument results, action owners and the recommended retest date.Record
Works with your existing IT/MSP
Independent validation that works with your existing IT/MSP.
Your IT/MSP may operate the platform: your IT company, Microsoft partner, cloud provider or backup supplier may configure and monitor the underlying service.
Your organization makes the business decisions: you determine what information is critical, how much data loss is acceptable, who can authorize recovery and how long priority work can remain unavailable.
CyberTECT validates the recovery picture: CyberTECT clarifies responsibilities, reviews available evidence and validates selected recovery paths with your organization and IT/MSP.
What the client receives
A recovery baseline the organization can maintain and retest.
Coverage map
Critical information, systems, protection methods, retention and known exclusions.
Responsibility matrix
Business owners, administrators, providers, approvers and recovery contacts.
Recovery objectives
Observed RPO, RTO and maximum tolerable downtime assumptions for priority operations.
Restore-test record
Scope, date, result, elapsed time, limitations and confirmation of usability.
Priority actions
Coverage gaps, access issues, provider dependencies and recommended corrections.
Owner summary
A plain-language record of what is proven, what remains conditional and what should be retested.
Who it is for
Especially useful where data and recovery knowledge are concentrated.
The service is designed for rural and small Ontario businesses, professional offices, law and real-estate practices, municipal and community organizations, Microsoft 365-dependent teams and businesses that rely heavily on an outsourced provider or one knowledgeable administrator.
Small businesses
Where downtime, missing files or unavailable email can quickly stop sales, service and administration.
Professional offices
Where client information, confidentiality and specialized systems make recovery time-sensitive.
Rural organizations
Where limited local support, vendor distance and small teams can increase recovery dependency.
Start free
Check whether recovery confidence is supported by evidence.
The focused Control Check covers backup testing, approved storage, continuity, recovery records and leadership oversight.
- Five plain-language questions.
- Immediate result and 30/60/90-day actions.
- No files, credentials or email address required.
Service boundary
Validation increases confidence. It does not create a permanent guarantee.
CyberTECT provides: coverage and responsibility review, coordinated representative testing, documented evidence and practical follow-up.
The result remains conditional: systems, providers, configurations, data and threats change. Recovery capability must be monitored and revalidated.
Higher-impact testing is separately planned: complete failover, production cutover and complex application recovery require explicit authorization, technical coordination and an agreed test plan.
Frequently asked questions
What Backup and Recovery Validation can establish.
The goal is a realistic, repeatable recovery path, not a dramatic test that creates avoidable operational risk.
Does using Microsoft 365 or another cloud service mean the data is fully backed up?
Coverage depends on the service, configuration, retention settings and any separate backup product. The validation establishes what is actually protected and what remains excluded.
What is a representative restore test?
It is a controlled recovery of selected business data, such as an email, file or folder, chosen to verify the expected recovery path without disrupting normal operations.
Can CyberTECT validate backups managed by another provider?
Usually, with the organization’s authorization and suitable cooperation from the provider. The scope records who performs each step and what evidence is available.
Does a successful test guarantee every future recovery?
No. A test provides evidence that a defined recovery path worked at a particular time. Coverage, monitoring and testing must remain current as systems and data change.
Related authoritative resources
Canadian and technical guidance used to inform this service.
The public list is intentionally selective. These sources cover recovery objectives, backup practices, small-business controls, Microsoft 365 recovery and cybersecurity event recovery.
- Cyber Centre: Developing your IT recovery planCritical systems, business impact, RPO, RTO, responsibilities and recovery testing.
- Cyber Centre: Tips for backing up your informationBackup storage, separation, 3-2-1 practices, roles and routine restore testing.
- Cyber Centre: Baseline controls for SMEsEssential backups, encryption, restricted access, offline storage and restore verification.
- Cyber Centre: Ransomware playbookMultiple recovery copies, offline protection, testing and service-provider dependencies.
- Microsoft: Overview of Microsoft 365 BackupExchange, SharePoint and OneDrive backup architecture, recovery points and restore capabilities.
- NIST SP 800-184: Guide for Cybersecurity Event RecoveryRecovery planning, playbooks, realistic testing, metrics and continuous improvement.
Know what recovery would actually require.
Review the systems, people and providers your business would depend on before an outage, account compromise or ransomware incident forces the question.
Information and authoritative sources last reviewed: July 2026.
CyberTECT periodically reviews Canadian cybersecurity guidance, Microsoft documentation and recovery standards. References are updated when material guidance or platform changes are identified.