Book the hour with whoever can sign in to your backup tool, and bring your computer list and a blank exceptions sheet. Give each of the three blocks below twenty minutes, and log anything unfinished as an exception rather than letting it run over.

Before the hour starts

Ten minutes of preparation saves the first block from stalling. Gather these items before anyone sits down:

  • A staff list, plus a note of every shared machine such as a front-desk PC, a conference room computer or a laptop kept for visitors.
  • The name of your backup product and the sign-in for its console, or the name of the person who has it.
  • A spreadsheet or page with four columns: the item, the owner, the next action and the date. This is the exceptions sheet.
  • A phone with a stopwatch, because the restore time is one of the results you are recording.

Block one: restore and open a sample file

Pick an ordinary, non-sensitive file that changed recently, such as a price list or a meeting agenda. Restore a copy from a specific earlier date into a new folder, never over the original, then open it and confirm the contents match that date. Write down the file name, the date you restored from and how many minutes it took.

Use the backup tool itself, not a recycle bin, and do not count a success email as a test. A success email says a job finished, not that a person can get a usable file out of it. If the restored file shows this week's changes, you picked the current version rather than the earlier date, so choose the restore point again.

If the only restore option available replaces the current file, run the drill on a throwaway test file you created for the purpose, not on a real document.

Anything that slowed you down goes on the exceptions sheet. Other common culprits are a sign-in code sent to one person's personal phone and a retention period shorter than you assumed.

What the restore actually tells you

A single successful file restore proves four things: the backup job ran, the data is readable, someone can reach it, and you know how long a small recovery takes. It does not prove that a whole computer or server can be rebuilt, because that is a bigger exercise with more moving parts. For that reason, treat the hour as a floor, not a ceiling.

CISA's StopRansomware Guide recommends offline, encrypted backups of critical data, noting that many ransomware variants try to find and delete or encrypt accessible backups. It also recommends regularly testing backups for availability and integrity. If your only backup sits on a drive or share that is always connected, log that as an exception.

The same guide advises keeping golden images of critical systems, which it describes as preconfigured operating system and application templates that can be quickly redeployed. For a small office, the practical question is: if the main server or the owner's laptop disappeared tonight, what would you restore it onto, and who knows how.

Decision criteria for the restore block

Use these tests to decide whether the result is a pass, a pass with an exception, or a fail:

  • A pass means the file opened, the contents matched the chosen date, and a second person could have repeated the steps from your notes.
  • A pass with an exception means the file opened, but only one person could do it, or it took far longer than you would accept in a real outage.
  • A fail means the file could not be found, would not open, or showed the wrong version. Treat this as the first action on the sheet, ahead of everything else.

Block two: check each device against vendor support

This block compares what you own with what vendors still support. Work from your staff list, one row per computer: owner, device, operating system and version, Office version, and a status column. Fill the status column with supported, ending soon, ended or unknown.

How to check a Windows PC

On each Windows PC, right-click Start, choose Windows Settings, then select System and About. Under Windows specifications, record the edition and version. The edition changes the end date: Microsoft says each Windows 11 feature update comes with 24 months of support for Home, Pro, Pro for Workstations and Pro Education editions, and 36 months for Enterprise and Education.

Microsoft's release information and lifecycle pages give these dates:

  • 26H2 Home and Pro are supported until October 10, 2028, and Enterprise and Education until October 9, 2029.
  • 26H1 comes only on certain new devices from 2026, not as an update to existing PCs, and Home and Pro are supported until March 14, 2028.
  • 25H2 Home and Pro are supported until October 12, 2027, and Enterprise and Education until October 10, 2028.
  • 24H2 Home and Pro ended on October 13, 2026, while Enterprise and Education run to October 12, 2027.
  • 23H2 has ended in every edition, most recently in Enterprise and Education on November 10, 2026.

Microsoft updates its release information page as releases change, so confirm against it on the day of your review.

The fix for a PC on an ended Windows 11 version is usually an update to a version still in support, not a new computer. Book that update, and note it as an exception with a date. A PC that cannot move to a supported version at all is the one to price for replacement.

What to do about Windows 10

Windows 10 support ended on October 14, 2025. Since then, Microsoft provides critical and important security updates only to PCs enrolled in the paid Extended Security Updates (ESU) program, which requires Windows 10, version 22H2. Microsoft lists the price for organizations as $61 per device for year one, doubling each year for up to three years, and a PC that joins in year two must also pay for year one. Mark each Windows 10 PC as enrolled or due for replacement.

Microsoft's ESU documentation adds several details that matter for the decision:

  • ESU is sold by the year. Partial periods are not available.
  • It covers security updates only. It does not include new features, and technical support is limited to problems with the ESU itself.
  • Organizations can receive ESU for a maximum of three years after Windows 10 end of support.
  • Windows 10 PCs keep working without ESU, but Microsoft recommends upgrading eligible PCs to Windows 11 or moving to a new Windows 11 PC.

Using Microsoft's rule that the price doubles each year, one PC would cost $61 in year one, $122 in year two and $244 in year three, or $427 over all three years. A PC enrolled for the first time in year two would pay $183 for the two years combined. Those figures come from Microsoft's list price of $61 per device for year one through volume licensing, and your reseller may quote differently, so treat them as a starting point for the comparison against a replacement.

Office versions

Office 2016 and Office 2019 support ended the same day as Windows 10, October 14, 2025. Microsoft's 2026 lifecycle list shows Office 2021 retiring and Office LTSC 2021 reaching end of support on October 13, 2026. Record each PC's Office version next to its Windows version.

Microsoft's guidance for Office 2016 and 2019 is that the apps may keep running, but without security fixes you could face serious security risks. Any Office on the 2021 line belongs on the sheet with a date.

How to check a Mac

On a Mac, choose About This Mac from the Apple menu; the window shows the macOS name and version number. Apple's security releases page lists macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3, all released November 9, 2026, as its newest macOS updates. Sonoma 14 is not in that batch, and its newest entry, 14.8.9, is dated August 6, 2026.

Treat a Mac that is behind the newest release for its version, or on a version left out of the latest batch, as an exception. The page is a list of security releases, so a missing version is a reason to investigate, not proof of anything by itself. Check that the Mac is actually on the newest release of its own version before drawing a conclusion.

Complete the inventory

Last, count the rows against your staff list plus shared machines such as a front-desk PC. A computer in use but missing from the list is an exception too. CISA's guide says to maintain a comprehensive asset management approach, including physical assets such as hardware and logical assets such as data and software, and to identify the most critical assets so restoration can be prioritized.

Put a mark next to the two or three machines whose loss would stop the office, such as the one that runs accounting software or holds the shared files. Those are the ones to restore first in a real incident, so they deserve the most attention in the backup test.

Common mistakes and how to spot them

Most of what goes wrong in this review is predictable. These are the patterns to watch for:

  • Counting a green status light as a test. Spot it by asking when someone last opened a restored file.
  • Restoring over the original. Spot it by checking whether the destination was a new folder.
  • A backup that lives on the same always-connected drive as the data. Spot it by asking whether the backup would still exist if ransomware reached the office network.
  • Relying on one person. Spot it by asking who else can sign in to the backup console and the Microsoft or Google admin account.
  • Forgetting shared and old machines. Spot it by walking the office and comparing what you see with the list.
  • Assigning an action to "IT". Spot it by looking for a person's name in the owner column.

Block three: owners and dates for exceptions

Every exception gets one named person, not "IT" or "the vendor", plus a next action and a date. Keep the action small: "replace old laptops" stalls, while "get two laptop quotes by December 4" gets done.

Mark the one action that can be finished first. A good choice is a task one person can close without a purchase, such as adding a second backup administrator.

Sort what is left by consequence: anything that leaves you unable to recover data comes before anything that merely leaves a computer out of date.

A worked example

Imagine a nine-person insurance agency. The restore works but takes 25 minutes, because the office manager, the only person who can sign in to the backup tool, has to reset the password first. The inventory finds six PCs on Windows 11 Pro 25H2, two on Windows 11 Pro 24H2 and one Windows 10 PC kept for an older scanner's software.

Reading the dates above, the six 25H2 PCs are supported until October 12, 2027. The two 24H2 PCs are already past October 13, 2026, so they are no longer receiving updates for that version. The Windows 10 PC can only be kept supplied with security updates by enrolling it in ESU or by replacing it. Microsoft's page says a PC that joins in the second year pays for year one as well, so the list price for one PC enrolling for the first time in year two would be $183 for the two years combined, and the reseller should confirm which year applies on the day.

The exceptions sheet gets three lines. The office manager will add a second backup administrator by Friday, the action marked to finish first. The office manager will also book the two 24H2 PCs for an update to a supported version by December 11. The agency owner will price ESU against replacing the PC and scanner and decide by January 8.

The record goes to the office manager as owner of the next review. It lists the 25-minute restore, the nine-PC inventory and the three dated actions.

Send a short record

Send the results to the person who owns the next review. Include what was tested, where it failed and which action can be finished first. Keep the record short enough to update next month.

A useful record fits on one page. It names the file you restored and the date you restored it from, gives the time it took, lists the inventory count, and repeats the exceptions sheet. Store it somewhere more than one person can reach, and keep a printed copy with your other recovery information, because a record kept only on the computers you are trying to recover is little help during an outage.

How to verify the result

Check your own work before closing the hour. Confirm that the restored file is a different version from the live one, by looking at its contents or its modified date. Confirm that the inventory row count matches the staff list plus shared machines. Confirm that every exception has a person, an action and a date, with none left blank.

Then check the recovery side. CISA's guide recommends maintaining a basic incident response plan and a communications plan, with an offline copy available, and having them approved in writing by the chief executive or equivalent. If you do not have a one-page version of either, add that as an exception with an owner.

Two further items belong on the sheet if you cannot answer them. The guide recommends phishing-resistant multifactor authentication for all services, particularly email, VPNs and accounts that access critical systems, and says to escalate any systems that cannot enforce it. It also lists CISA, your local FBI field office, the Internet Crime Complaint Center or the U.S. Secret Service as places to report an incident. Knowing who you would call is part of being ready.

Short answers readers ask next

A restore of one file is enough for this hour. A full rebuild test is a larger exercise to schedule separately.

A Mac or PC that cannot be updated further is not an emergency, but it is an exception with a replacement date. Put a person and a quote deadline next to it.

Cloud-based files and email still need a restore test. Whether the vendor keeps versions, for how long, and who can restore them are questions for your own account, so check the retention setting in your admin console and write down the answer.

What to do this week

Finish the single action marked first, and send the record to the owner of the next review. Book the updates for any computer on an ended Windows 11 version. Decide on each Windows 10 PC, either by enrolling it in ESU or by scheduling its replacement. Add a second person who can sign in to the backup tool and your main admin accounts. Put the next review on the calendar before the sheet goes cold.

Where ALCO can help

ALCO's services include backup and disaster recovery, mobile device management, asset tags and asset management, and IT consulting and vCIO. The ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person. ALCO USA Inc is headquartered in Caldwell, Idaho, with technicians serving businesses across Idaho, and the Caldwell office takes visits by appointment, Monday to Friday, 9 to 5 Mountain Time, so book a time or call first.

Sources