India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Backup Assessment: Audit Coverage, Restore Success and Retention
A backup assessment is an evidence-based audit of an organisation's existing backups: which workloads are protected, whether their copies actually restore, how long restores take, how long data is kept and what it costs. NTSPL runs it across AWS, Azure, Google Cloud and on-premises tools for Indian enterprises preparing for audits, renewals or a ransomware-readiness review.
Delivered on
In scope
What a Backup Audit Measures That a Job Report Cannot
Backup reports usually measure job success, not recoverability. A job can finish green while backing up a volume that no longer holds the database, skipping a newly added disk, or writing to a vault that the same admin account can purge. In assessments NTSPL has run, a quarter to a third of production servers sat outside any backup policy because they were created after the policy was written, and fewer than one in ten restores had ever been timed. Retention is often the opposite problem: seven years of daily copies for scratch servers, billed every month.
NTSPL treats the backup estate as something to measure, not survey. We pull the inventory from cloud APIs and the hypervisor, pull protected items from every backup tool in use, and join the two to find gaps. Then we restore a sample of real workloads into an isolated network and time them. Retention and cost are scored against what the data actually needs under DPDP, RBI, SEBI, the Income-tax Act or CERT-In. The output is a ranked fix list, not a maturity score.
Signals That Your Backup Estate Needs an Independent Audit
Signals you need Backup Assessment
- Your inventory shows more servers, buckets or databases than your backup console lists as protected items, and nobody can explain the difference.
- The last restore anyone timed was more than 12 months ago, or restore tests only ever recover single files.
- Backup storage has grown more than 30% a year while production data grew under 10%.
- An RBI, SEBI or IRDAI inspection, ISO 27001 surveillance audit or cyber-insurance renewal asks for restore evidence in the next 60-90 days.
- You run two or more backup tools (for example Veeam on premises plus native cloud backup) with no single view of what each covers.
- A ransomware incident at a peer has leadership asking whether your backups could be deleted by a compromised admin.
When to choose something else
- You have no backups at all for a new cloud estate. There is nothing to audit; go straight to Cloud Backup Architecture and design policies from scratch.
- You need to decide which systems deserve DR beyond backup and what RTO each needs. That is a business impact question answered by the Disaster Recovery Assessment.
- You need someone to monitor daily jobs and handle restore tickets. That is a recurring run service (Backup Operations under Managed Cloud Services), not a one-time audit.
Six Areas Examined in the Backup Assessment
Coverage reconciliation
Every VM, disk, file share, bucket, managed database and SaaS dataset from the authoritative inventory is matched to a backup policy, with unprotected items listed by owner and environment.
Restore sampling
A stratified sample of 15-40 restores (VM, database, file, object) is executed into an isolated network, timed, and checked for application-level integrity rather than just boot.
Retention and legal fit
Retention per data class is compared with legal minimums such as 180-day CERT-In log retention, eight-year books of account and sector rules, flagging both under- and over-retention.
Copy isolation
We check whether at least one copy sits outside the production account or subscription, behind a vault lock or immutability setting, and outside production admin credentials.
Backup cost profile
Storage, snapshot, licence and egress costs are attributed per workload and tier, exposing orphaned snapshots, duplicate protection and copies on the wrong storage class.
Process and evidence
Failed-job handling, restore request records, change control for policies and the evidence pack an auditor would ask for are reviewed against what actually exists.
Backup Evidence Pipeline: From Raw Inventory to Ranked Fix List
Backup Evidence Pipeline
Inventory and backup catalogues are extracted read-only and joined into a single coverage dataset. Sampled restores and cost data are layered on to produce a scored, ranked remediation register.
Select any component
Backup Evidence Pipeline: click any of its 8 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Pulling Backup Evidence from AWS, Azure and Google Cloud
Backup Audit Manager frameworks give a quick control baseline, but NTSPL still joins AWS Config inventory to protected resources because resources outside any backup plan simply do not appear in plan reports. Restore testing plans run sampled restores on a schedule.
Business Continuity Center shows protectable but unprotected resources across subscriptions; NTSPL validates it with Resource Graph queries and checks whether vaults have immutability and soft delete enabled.
Cloud Asset Inventory exports are joined with Backup and DR Service protected resources and snapshot schedules in BigQuery, giving a queryable coverage table per project and label.
Judgement Calls in Scoring Backup Coverage and Retention
How many restores to sample
Sample every Tier 1 system at least once, then 10-15% of Tier 2 and a handful of Tier 3 chosen at random. For estates under 100 servers, 15-20 restores usually suffice; above 500 servers plan for 35-40. Include at least one restore from the oldest retained point, because long-term copies on archive tiers often fail or take days to rehydrate.
What counts as a successful restore
A VM that boots is not a pass. NTSPL defines success per workload class: databases must open and pass a consistency check plus one business query; file shares must match a checksum sample; applications must accept a test login. Anything that needs manual repair to work is recorded as a partial pass with the extra minutes added to restore time.
Treating over-retention
Retention longer than the legal or business need is flagged when it exceeds the requirement by more than 12 months or costs over INR 50,000 a month. Under the DPDP Act 2023, personal data should not be kept longer than its purpose needs, so excess retention of customer data is both a cost and a compliance finding.
Scoring isolation
Copies are scored on three tests: is there a copy outside the production account, is that copy protected by an immutability lock, and can a single production admin delete it. A workload passes only if all three hold. Snapshots in the same account count as convenience copies, not as backup isolation.
Four-Week Backup Audit Schedule
Access and inventory extraction
Read-only roles are provisioned in each account, subscription and project, and inventory plus backup catalogues are exported. Data owners approve the restore sampling plan.
Coverage and retention reconciliation
Inventory is joined to protected items, gaps are attributed to owners, and retention is mapped against data classes and legal minimums.
Sampled restores in a sandbox
Selected backups are restored into an isolated network, validated at the application layer and timed from request to app-ready.
Cost attribution and isolation scoring
Backup spend is attributed per workload, waste is priced, and each critical workload is scored on the three isolation tests.
Findings readout and fix register
Findings are ranked by exposure and effort and walked through with IT, security and audit, with owners and dates agreed for the top 20.
What you receive
Backup Health Indicators Reported at Close
| KPI | Typical target |
|---|---|
| Production resources with an active backup policy | Baseline measured; target 98%+ after remediation |
| Sampled restores passing application-level validation | Baseline measured; target 95%+ |
| Slowest Tier 1 restore versus stated RTO | Within RTO, or a dated fix item |
| Critical workloads passing all three isolation tests | 100% of Tier 1 |
| Backup spend identified as waste | Typically 15-30% of backup storage cost |
Where Backup Audits Go Wrong and How NTSPL Avoids It
| Risk | How NTSPL prevents it |
|---|---|
| Audit restores touch personal data and create a new exposure | Restores run in a sandbox with no internet egress, access limited to named engineers, and automatic teardown within 48 hours; data owners approve the sample list first. |
| Relying on the backup tool's own coverage report | Coverage is always derived from the provider inventory joined to protected items, so resources the tool has never seen still appear as gaps. |
| Findings land as a long list nobody owns | Every finding carries a named owner, an effort estimate and a date; the top 20 are agreed in the readout before the report is issued. |
| Restoring large archive-tier copies stalls the audit | Archive rehydration is started on day one of the restore window and measured as part of the finding, since slow rehydration is itself an RTO risk. |
Backup assessment vs backup monitoring: do I need both?
Yes, but they answer different questions. Monitoring tells you whether last night's jobs ran; an assessment tells you whether the estate as a whole can be recovered. Monitoring will never flag a server that was never added to a policy, a retention ladder that is three times too long, or a vault an admin can purge, because those are design gaps, not job failures. Run an assessment once to reset the baseline, after major migrations, and before regulatory inspections. Then let monitoring and monthly restore tests keep it healthy. If you can only fund one this year and have never audited, start with the assessment.
Key facts: Backup Assessment
Backup Assessment in Practice
2 Backup Assessment scenarios, from Chartered accountancy and audit and Payroll outsourcing bureau, plus related platform case studies.
CA firm finds 9 of 34 servers unprotected weeks before its peer review
Payroll bureau cuts backup spend 41% and proves restores for 1,100 client payrolls
Multi-specialty hospital cuts HIS recovery time from 2 days to 38 minutes
3PL operator cuts warehouse system recovery time from 2 days to 45 minutes
Backup Assessment: Frequently Asked Questions
How long does a backup assessment take and what does it cost?
A typical engagement takes four weeks. For an estate of 100-400 servers across one or two clouds plus on-premises, effort is usually 25-40 consultant days. The largest variable is restore sampling: archive-tier restores and multi-terabyte databases add elapsed time but little effort. NTSPL quotes a fixed fee after a one-hour scoping call.
Will the assessment change anything in our production environment?
No. Extraction uses read-only roles, and restores go into a separate sandbox network with no route to production. The only artefacts created are the temporary audit roles and the sandbox, both removed at close and documented in the evidence pack.
Does a backup assessment help with RBI or SEBI inspections?
Yes. RBI's IT governance direction for regulated entities and SEBI's cybersecurity and cyber resilience framework both expect tested backups and documented recovery. The evidence pack includes timed restore logs, coverage reconciliation and retention justification, which are the artefacts inspectors typically ask for.
Can you assess Veeam or Commvault, not just cloud-native backup?
Yes. Most Indian estates run a mix. NTSPL pulls job and catalogue data from Veeam, Commvault, Veritas and native cloud services, and reconciles all of them against one inventory so double-protected and unprotected workloads are both visible. Licence counts and agent versions are also checked, since outdated agents are a frequent cause of silent failures.
What if the audit finds our backups cannot be restored?
Then it has done its job. Unrestorable Tier 1 items are escalated within 24 hours, not held for the final report, and NTSPL proposes an immediate interim fix, such as an extra snapshot schedule or a manual export, while the proper design change is planned.
Do you look at Microsoft 365 or Google Workspace backups?
Yes, if they are in scope. Mailboxes, OneDrive, SharePoint and shared drives are commonly assumed to be protected by the provider's retention. The assessment checks whether a separate backup exists, what it covers and whether restores of a deleted site or mailbox actually work.