We have backups, but no one has tested recovery. Can we launch?
Unproven recoverabilityBackup completion does not show that the service can be restored within its required recovery targets. Ask the operations owner to run an authorized restoration exercise, validate data and dependencies, and record any gap in the launch decision.
What to do now
- Confirm required recovery objectives
- Select a safe restoration exercise
- Validate restored data and dependent services
- Resolve gaps or obtain an authorized risk decision
When to escalate
Recovery cannot meet the service's agreed needs.
The qualified security privacy legal or control owner
Example
A restore exercise reveals that configuration files were missing from the backup scope.
Mistake to avoid
Using a successful backup job as a substitute for a restoration test.
Prevent a repeat
Review access and controls when scope changes; obtain qualified advice for legal, regulatory and high-impact security decisions.
Suggested ApprovedFlow setup
- Documents
- Tasks
- Approvals
Track remediation tasks and non-sensitive review evidence; restrict sensitive incident or security detail through the authorized systems and permissions. See the platform
Related cases
- Security review is scheduled one week before launch. What should I do?Late security assurance
- The security checklist is complete, but permission tests were never run. Is that enough?Unverified authorization controls
- How do we validate a new project dashboard before launch?Untested management information
- How do we prove every requirement was delivered and tested?Missing requirements traceability