The short answer: A green check mark next to a backup job only tells you that the job completed—not that the business can get back up and running from it. According to the vendor, an integrity check in Synology Hyper Backup verifies that the job can continue and that the backup can be restored, but it does not transfer any data. A restore test, on the other hand, means restoring the backup away from production and checking that the recovered systems and data actually work. Vyhláška č. 409/2025 Sb. requires regulated entities under the higher-obligation regime to test recoverability and document the results. The regulation for the lower-obligation regime does not explicitly require this, and neither regulation specifies a particular interval.
The most expensive sentence we hear from clients is: „We have a backup.„ Then comes a pause: „We’ve just never tried restoring it." At that point, the business does not know whether it has a backup or merely backup software—and the difference only becomes clear on the day its operations depend on it.
This article does not address who is covered by Zákon č. 264/2025 Sb. o kybernetické bezpečnosti; that is covered in our separate overview of Zákon č. 264/2025 Sb.. It focuses on one thing only: what a restore test is, what the implementing regulations actually say about it, and how a business with a NAS can complete one in an afternoon—including a test record that can be presented to someone else.
An integrity check is not a restore test
These two things are commonly confused because they look similar in the interface: both end with a green status indicator.
An integrity check verifies the backup itself—whether the data in the repository matches what the backup software wrote there. For Synology Hyper Backup, the vendor states that an integrity check verifies whether the job can continue and whether the backup can be restored, but it does not transfer any data. It checks the condition of the archive; it does not test the restoration process.
A restore test reverses the direction of data flow. You take a backup, restore specific data or an entire machine to a safe destination, and verify that the recovered item can actually be used: the database starts, the accounting application opens last year’s records, and the shared folder contains the latest documents.
The difference is practical. An integrity check will not reveal that:
- the backup has been running without errors for years but does not include a folder that someone moved elsewhere;
- the database is backed up while running without a consistent snapshot and will not start after restoration;
- only one person knows the key to the encrypted backup, and that person is on holiday;
- restoring 900 GB over the internet takes three days, meaning that „the backup exists„ and „the business will be operating tomorrow" are two different claims.
What the regulations say about restore testing—and what they do not
Two implementing regulations have been in force since 1 November 2025, and they differ precisely on this point. Which regime applies to a business depends on its classification under the Act; the table below only summarises what each regulation requires for backups.
| Topic | Lower-obligation regime—vyhláška č. 410/2025 Sb. | Higher-obligation regime—vyhláška č. 409/2025 Sb. |
|---|---|---|
| Backups | § 6 písm. c) requires „pravidelné zálohy" (regular backups) | § 26 odst. 3 písm. a) requires „pravidelné testování jejich integrity, dostupnosti a obnovitelnosti" (regular testing of their integrity, availability, and recoverability) |
| Evidence of testing | It contains no explicit requirement to test recoverability | § 26 odst. 3 písm. b) requires „dokumentování výsledků" (documentation of the results) of these tests |
| Backup protection | — | § 26 odst. 3 písm. c) requires protection at least through encryption under § 25 |
| Separation of the backup environment | § 11 písm. a) requires network segmentation „včetně oddělení provozního a zálohovacího prostředí" (including separation of the production and backup environments) | § 26 odst. 5 requires the backup environment to be separated from other environments |
| RTO and RPO | — | § 15 písm. c) requires the recovery time and data recovery point to be defined |
| Plan testing | — | § 15 písm. e) requires organisations to „pravidelně testovat plány kontinuity činností a plány obnovy" (regularly test business continuity and recovery plans) |
Three conclusions follow from this and are worth stating clearly.
First, the widespread claim that „the law requires a restore test every month" is false. Neither regulation specifies a particular testing frequency. Vyhláška č. 409/2025 Sb. uses the word „pravidelné" (regular); the business must determine what that means based on its own risks, agreed RTO and RPO, and the frequency of changes in its environment. Anyone selling you an interval as though it were quoted from the law is quoting themselves.
Second, the obligation to test recoverability and document the results appears in the rules for the higher-obligation regime, not the lower-obligation regime. Vyhláška č. 410/2025 Sb. requires backups to be performed regularly but contains no explicit requirement to test recoverability. An untested backup, however, becomes an operational problem long before it becomes a legal one.
Third, both regulations address the separation of the backup environment. The lower-obligation regime covers it under network segmentation, while the higher-obligation regime states it as a separate requirement. In practice, the principle is the same: backups should not depend on the same account or reside in the same network segment as production systems.
The implementation deadlines are set by Zákon č. 264/2025 Sb. itself: § 6 odst. 1 requires a regulated service to be reported to Úřad (the authority) no later than 60 days after the relevant conditions have been met, while § 13 odst. 4 requires security measures to be implemented no later than one year after delivery of the registration decision. A year sounds like plenty of time—until you attempt your first restore test.
The numbers that make this more than a paperwork exercise
On 23 April 2025, Veeam published a survey of 1,300 organisations, 900 of which had experienced a cyberattack. Over the preceding twelve months, 69% of respondents had been affected. What happened next is even more important:
- only 10% of affected organisations recovered more than 90% of their data;
- 57% recovered less than half;
- 66% of backup repositories were affected by the attack.
The last figure explains why both regulations insist on separating the backup environment. Once attackers gain access to a network, the first thing they target is not necessarily the data—it is whatever could bring that data back. A business whose backup sits on the same NAS and in the same domain as production effectively has one copy, not two. If neither the storage array nor the production server contains anything usable, the problem becomes a different discipline altogether: server data recovery, with an uncertain outcome and at a very different cost from a planned test.
How to test a Synology restore step by step
This procedure assumes a Synology NAS running DSM and backups created with Hyper Backup or Active Backup for Business. It should take about half a day if you prepare the restore destination in advance.
1. Choose what to test. Do not test everything at once. Select one system that the business depends on—accounting, a file server, or the job database—and one scenario, such as „restore the shared folder to its state one week ago„ or „start the accounting server from a bare-metal backup."
2. Prepare a destination outside production. Restore to a virtual machine, replacement hardware, or a temporary shared folder—never overwrite live data. Active Backup for Business supports bare-metal recovery through Recovery Media Creator and instant restore to vSphere, Hyper-V, or Synology VMM. The last option allows the test machine to start directly on the NAS.
3. Record the start time. Without it, the test will not produce a recovery-time measurement—only a vague impression that „it was fairly quick."
4. Restore the data. In Hyper Backup, use Backup Explorer to select the version and restore destination. In Active Backup, choose individual files, an entire volume, or direct machine startup, depending on the scenario.
5. Verify that the restored items work. This is where the exercise either becomes useful or turns into theatre. Open three to five specific files, start the application, sign in, and check the most recent posted accounting document. Verify the content, not merely the folder size.
6. Record the completion time and the gap against the RPO. If the latest backup ran overnight and the system fails in the afternoon, the business loses an entire working day. That is information for management, not just IT.
7. Clean up and document the test. Delete the test machine and restored folder, then store the test record somewhere you will still be able to find it a year later.
Check capacity in advance: according to the vendor, Active Backup for Business can process no more than 10 file servers concurrently and either 10, 30, or 50 computers and virtual machines, depending on the NAS memory capacity. For virtualised environments, Veeam Backup & Replication Community Edition is an alternative. It is free for up to 10 instances, with a workstation counting as one instance and a server as three.
Restore test record template
Vyhláška č. 409/2025 Sb. requires organisations in the higher-obligation regime to document test results but does not prescribe a form. A single page is enough if it answers the question: „What did we test, how did it turn out, and what will we do about it?"
| Field | What to enter |
|---|---|
| Test date and time | Start and finish times, not just the date |
| Person who performed the test | Name and role; include the company if performed by a supplier |
| System tested | Specific server, shared folder, or database |
| Backup source | Job, repository, and version/date of the backup being restored |
| Restore scenario and destination | For example, restoring a volume to VMM and where it was restored |
| Recovery time | Measured time until the system became operational |
| Data loss | Age of the restored backup relative to the time of failure |
| Functionality verification | What was checked and with what result |
| Result | Passed / passed with reservations / failed |
| Issues identified | Missing folder, unknown password, slow connection |
| Corrective actions and deadline | Who will fix each issue and by when |
| Relationship to RTO and RPO | Did the result meet the defined targets? |
The second-to-last row is the most valuable. A test that finishes with a green status and changes nothing is merely evidence that a test took place. A test that leads to the backup scope being corrected or access to the encryption key being added can save the business a full day of downtime.
What the first test most often reveals
Based on what we see at businesses performing a restore test for the first time:
- The backup scope no longer reflects reality. It still reflects the environment as it existed when the job was created. A new folder or server has not been added.
- The database is backed up as a live file. The restore completes, but the service will not start. This needs to be addressed through snapshots or the database’s native backup mode.
- No one has the encryption key. The backups are intact and unreadable. The key must be stored outside the system it protects—and outside any one person’s memory.
- The RTO exists only in someone’s head. Management expects recovery within an hour, while the technical reality is two days. A test is the only way to discover that gap before an outage.
We summarise what a testable backup setup looks like—a local copy, separate storage, and an off-site copy—on our business backup services page.
Frequently asked questions
Does the law require a restore test every month?
No. For backups, vyhláška č. 409/2025 Sb. refers to „pravidelné testování" (regular testing) of integrity, availability, and recoverability, as well as documentation of the results, but it does not specify a particular interval. Each business determines the frequency based on risk, agreed RTO and RPO targets, and how often its environment changes.
Is an integrity check in Hyper Backup sufficient evidence of a restore test?
According to the vendor’s description, an integrity check verifies that the job can continue and that the backup can be restored, but it does not transfer data. Demonstrating recoverability means actually restoring the backup and verifying its contents.
Our business is in the lower-obligation regime—must we test restoration?
Vyhláška č. 410/2025 Sb., § 6 písm. c), requires backups to be performed regularly but does not explicitly require recoverability testing. In § 11 písm. a), however, it requires network segmentation, including separation of the production and backup environments. These provisions therefore do not make restore testing mandatory, but it remains a sensible operational measure regardless of the applicable regime.
What if the test fails?
That is the most useful result possible—you discovered the problem on a day of your choosing. Record what failed, assign a corrective action and deadline, and repeat the test once the issue has been fixed.
If you do not feel confident carrying out your first test yourself, or need to configure your backups so that testing is possible at all, contact us. We will review the backup scope, separation of the backup environment, and the test record you need to withstand an inspection.
Sources
- Vyhláška č. 409/2025 Sb. (higher-obligation regime), § 15 and § 26 — https://www.e-sbirka.cz/sb/2025/409
- Vyhláška č. 410/2025 Sb. (lower-obligation regime), § 6 and § 11 — https://www.e-sbirka.cz/sb/2025/410
- Zákon č. 264/2025 Sb. o kybernetické bezpečnosti, § 6 and § 13 — https://www.e-sbirka.cz/sb/2025/264
- Veeam, press release dated 23 April 2025 — https://www.veeam.com/company/press-release/veeam-report-finds-close-to-70-percent-of-organizations-still-under-cyber-attack-despite-improved-defenses.html
- Synology: Hyper Backup—data backup settings — https://kb.synology.com/en-uk/DSM/help/HyperBackup/data_backup_settings?version=7
- Synology: Active Backup for Business—specifications — https://www.synology.com/en-us/dsm/7.4/software_spec/abb
- Veeam: Backup & Replication Community Edition — https://www.veeam.com/blog/backup-replication-community-edition-features-description.html
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).