Approving the Backup Invoice? What a Restore Test Costs and Who Eats the Overrun

The decision usually arrives as an invoice someone else has already read. A managed service provider bills monthly for backup, the renewal lands in November or December, and the person signing it is not the person who would sit at a keyboard at seven in the morning trying to get a shared drive back. That gap matters more than the dollar figure. What you are actually buying is not storage, which is cheap and getting cheaper, but a promise about how fast data comes back and who absorbs the cost when that takes longer than the proposal implied.

The ordinary week looks like nothing happening

Week to week, a working backup produces almost no evidence of itself. A green check in a dashboard nobody opens, an automated email that gets filtered into a folder, a monthly report summarizing job completion rates that are always in the high nineties. None of that tells you the thing you need, which is whether a specific file, mailbox, or server can be brought back in a usable state by a person who has never done it before. Completion of a backup job and successful restoration of data are two separate facts, and only the first one gets reported by default.

This is why the seasonal calendar is useful rather than sentimental. Late in the year, most small offices go quiet for a stretch: partners take time off, the accounting close pauses, and change freezes stop anyone from deploying anything new. That quiet is the only period in the year when you can deliberately take a system down, restore it from a backup, and compare it against what it should look like, without half a dozen people needing it at once. It is also, not coincidentally, the period when a ransomware incident does the most damage, because the people who would notice are not there.

Ten years ago the risk sat in a closet, now it sits on the bill

A decade back, the standard arrangement for a small firm was a capital purchase. You bought an appliance or a tape autoloader, you paid a fixed price with an installation fee, and the vendor's involvement mostly ended once the box blinked. The risk you carried was physical and obvious: the closet flooded, the tapes degraded, the one person who understood the rotation left, and nobody discovered any of it until a restore was needed. The cost was known in advance, and the exposure was entirely operational. You owned the hardware and you owned the failure.

Now the same firm rents. Backup is a per-seat or per-terabyte subscription, the data sits in someone else's data center, and the monthly number is predictable in a way the old model never was. What changed is where the uncertainty went. It moved from the closet to the terms of service, into the parts of the agreement that describe restore requests, data egress, recovery time objectives, and what happens when you need everything back at once rather than a single deleted file. The steady monthly charge is real. So is the variable charge sitting behind it, which almost nobody prices out until the day they need it.

The National Institute of Standards and Technology is responsible for the cybersecurity framework that most of these contracts gesture at, and recovery is a named function within it, distinct from protection and detection. That distinction is worth carrying into a vendor conversation. A provider can be excellent at capturing data and mediocre at giving it back, and the contract is where you find out which you have bought.

Fixed price, day rate, cost plus, and who absorbs the overrun

A restore test can be procured three ways, and the difference is entirely about who pays when it runs long. Under a fixed price, the provider quotes a single number to restore an agreed set of systems to a test environment and produce a written result. If it takes twice as long as they estimated, that is their problem, and they will have priced a cushion into the quote to account for it. You pay more on average and you know the number in advance. For a first test, where nobody has any idea how long the work takes, this is usually the right trade.

A day rate moves the risk to you. You pay for engineer hours, and every unexpected complication (a corrupted index, an authentication dependency nobody documented, a virtual machine that will not boot on unfamiliar hardware) is billed. The rate is lower, and if the environment is well understood the total will beat a fixed quote. Cost plus sits in between and shows up most often in cloud arrangements: a defined fee for the provider's labor, plus pass-through charges for compute and data transfer that they do not control and will not absorb. Read which costs are passed through, because restore egress is the one that surprises people.

The practical answer for most small organizations is to buy the first test fixed price, on the understanding that it is partly an assessment, then move to a day rate for the annual repeat once the scope is documented and the timings are known. Say plainly in the engagement letter what a successful test means: which systems, restored to what state, verified by whom, and what report you receive.

What to schedule before the office empties

Pick a week when the building is quiet and book it now rather than in January. Ask for a restore of one full server and one user's mailbox, timed and documented, with the result written down and dated. Ask what the restore would have cost in transfer charges had it been the whole environment. Keep the answer with the renewal paperwork, because next year's signature is easier when the file already contains evidence rather than a dashboard.

The person who signs the invoice and the person who would run the recovery are rarely the same, and a dated test report is the only document that puts them in the same conversation.