A backup only counts if you also know that restoring it works. Not as an assumption, but as something you have actually tried: performed a recovery, measured how long it took and verified that everything was back as it should be. Without that test you only know that a copy exists somewhere — not whether that copy will ever help you.
For an installation company this is not a theoretical question. Behind the scheduling of technicians, the access codes of customer buildings and the connections with security systems are systems that, if they fail, not only affect your own business operations but also your client's access to their own premises. Whoever operates the service team that remotely controls a door, an alarm or a climate control system is a link in the chain that simply must keep functioning for that client.
Why an untested backup does not count
A backup can become unusable for all sorts of reasons at the moment you need it. The file is corrupt, the key to decrypt it is missing, the order in which systems must be restored is not documented anywhere, or it simply takes much longer than anyone expected. You won't notice that during a quiet Tuesday — you'll notice it when the scheduling of all your technicians has crashed and a customer asks why their access system has not responded for two days.
The due diligence obligation arising from the NIS2 Directive does not mention backup and recovery as a technical detail but as one of the core measures. What the Directive itself does not do is prescribe a fixed testing frequency — how often you test is nowhere stated as a concrete number in the text. Supervisors typically look at whether an organization can demonstrate that it knows which systems are critical and that it regularly checks whether recovery actually works, commensurate with how dependent the company is on those systems.
What specifically affects installation companies
For an installation company it is not just about your own accounting. Think of the scheduling software where technicians receive their routes and tasks, the CRM with customer contract data and warranty periods, and the connections with access systems or building management systems at clients. A technician who can access a customer's network via a VPN connection is an extra door into that customer's system — a door that must also be able to close if something goes wrong.
It is precisely those connections that make recovery more complicated than with a regular office system. It is not just about restoring your own data, but also about whether access rights, certificates and passwords for customer environments still work correctly after recovery. A test that only restores your own file system says little about whether the connection with a customer after an outage will work as agreed.
What a test concretely entails
A useful recovery test consists of a few fixed elements: you actually restore a backup, preferably in a separate environment so the test poses no risk to ongoing work. You measure how much time it takes and compare that with what is acceptable for your scheduling and for agreements with clients. You verify that all data is complete and usable, including connections with external systems. And you document who performed the test, when, and what came out of it — even if the result was not good, because that is precisely the reason to improve something.
That documentation is at the same time the evidence that a client can ask for in a security questionnaire, and the part that a supervisor expects to find in a file on due diligence. Anyone who wants to check for themselves whether that file is already in order, or still needs to start, can find in a quick check of where you stand an initial direction, with an explanation of why.
For companies unsure whether these obligations apply directly to them or primarily come through the requirements of a contracting party, the distinction between being directly obligated and being affected through the supply chain is often the starting point. That difference, and what it means for the rest of your measures, is explained between the topics selected for each situation.
Anyone left with mainly practical questions after reading such measures — about what an account includes, what remains free and what costs — will find most answers in the frequently asked questions about the platform. And for those who want to actually maintain the register, with a status and owner per measure, see the subscription page what goes with that.
Whether an untested backup poses a risk that a supervisor assesses differently than a tested one is not something this article can determine for you — it depends on your own systems and agreements, and for that the path to a legal advisor or the supervisor remains the right one. If you do want to first get a picture of where you stand, by all means take the free quick-scan or browse through the topics worked out for your sector.