# Recovery exercise scorecard

Agree on objectives with the business owner before the exercise. Record every time with a timezone and state when the recovery clock begins.

## Plan

**Service / business owner:** ____________________

**Exercise lead / participants and roles:** ____________________

**Exercise type:** tabletop discussion / walkthrough of the written procedure / functional restore into an isolated environment / full failover of the live service

**Recovery time objective:** ____________________  **Recovery point objective:** ____________________

**Where the objectives came from and when the business owner last confirmed them:** ____________________

**Scenario / authorized environment:** ____________________

**Backup or replica used, its location, and its age at the start:** ____________________

**Dependencies required for the service to be usable (identity, network, DNS, licenses, encryption keys, integrations):** ____________________

**Representative transaction:** ____________________

**Abort criteria and rollback if the exercise itself causes harm:** ____________________

## Milestones

| Milestone | Timestamp | Evidence / limitation |
| --- | --- | --- |
| Interruption begins |  |  |
| Interruption detected |  |  |
| Recovery authorized |  |  |
| Restore starts |  |  |
| Data available |  |  |
| Dependencies available |  |  |
| Business transaction accepted |  |  |
| Users informed that service is usable |  |  |

## Checks

| Check | Expected | Observed | Pass / fail / untested |
| --- | --- | --- | --- |
| Restored data age |  |  |  |
| Integrity / representative contents |  |  |  |
| Identity and permissions |  |  |  |
| Encryption keys and secrets available without the primary environment |  |  |  |
| Restore source was a copy isolated from the primary environment (offline, immutable, or separate account) |  |  |  |
| Written procedure and contact list were reachable without the primary environment |  |  |  |
| Business transaction |  |  |  |
| Integrations and scheduled jobs |  |  |  |
| Time objective |  |  |  |
| Point objective |  |  |  |

**Manual interventions / missing instructions:** ____________________

**Steps that depended on one specific person:** ____________________

**Unmet objective, owner, and retest:** ____________________

## Close-out

- [ ] Test copies are retired or retained under the approved plan.
- [ ] Temporary access is removed.
- [ ] Normal protection and monitoring are confirmed.
- [ ] Procedure updated with what was learned; version and date recorded.
- [ ] Results shared with the business owner and, where relevant, the people who ask for them in due diligence.

| Finding | Improvement | Owner | Due date / retest |
| --- | --- | --- | --- |
|  |  |  |  |

## Common failure modes

- The backup restores but nobody can sign in because identity was not part of the scenario.
- Objectives were set by the technical team and never confirmed by the business owner.
- The exercise is announced, rehearsed, and run by the one person who built the system.
- A pass is recorded for a tabletop as if it were a functional restore.

**Bounded conclusion and acceptance (state the exercise type in the conclusion):** ____________________

**Next exercise date / trigger (vendor change, major upgrade, new dependency, staffing change):** ____________________

This scorecard covers one service and one scenario. It does not establish firm-wide continuity; repeat it per Tier 1 service and vary the scenario.