Why it matters
A backup you've never tested restoring isn't a backup — it's an assumption.
How a self-led small team implements it
Test a real restore at least annually; this is the single most-skipped control at small companies and the easiest to fix.
What auditors expect to see
Restore test log with date and result.
Track A.5.30 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS