A backup job that reports success only tells you the job ran. To know the backup is usable, monitor four things: freshness, size, completeness and a periodic restore. Alert on the absence of a good backup, not just on error messages.
Why green is not enough
Backup tools can exit cleanly while saving an empty database, a partial dump, or a file the restore tool cannot read. A permissions change, a full disk or a renamed bucket can all produce a quiet, useless result. Nobody notices until the day of the restore.
The four signals
Freshness. Alert when the newest good backup is older than your target. This catches the job that stopped running, which sends no error at all. Tie the threshold to your recovery point objective from setting RPO and RTO.
Size. Track backup size over time. A sudden drop of most of the size, or a file that is suspiciously tiny, deserves a page. A sudden jump can mean unexpected data or an attacker staging data.
Completeness. After each run, verify what you can cheaply: checksum the file, list the archive, or run the database tool's own status check against it. Record the result with the backup.
Restorability. Once a week or month, restore the latest backup into a scratch environment and run a few queries. Automate it. This is the only check that proves recovery. The quarterly restore drill checklist covers the manual version.
Alert on silence
The classic failure is a monitor that waits for an error that never comes. Use a dead man's switch: the backup job pings a monitor on success, and the monitor alerts when pings stop. The same idea applies to log pipelines, as in detecting when a log source goes silent.
Watch who can change or delete backups
Alert on changes to backup retention, deletion of backup objects, and removal of the backup role. Attackers who reach your cloud account often try these steps early. See why ransomware attackers go after your backups.
Keep the evidence
Save the freshness report and restore results. They double as proof for auditors, as described in SOC 2 backup and restore test evidence.
Safeguard's compliance and evidence automation can collect this kind of proof alongside other controls. You can try a free scan at https://gold.safeguard.sh/scan.
Quick check
What is the cheapest useful backup alert?
An alert when the newest good backup is older than your target. It catches jobs that stop without any error.
Is a checksum enough?
No. It shows the file is intact, not that it restores. Restore into a scratch environment on a schedule.
Last reviewed: 19 October 2026.
