Agree on objectives with the business owner before the exercise. Record every time with a timezone and state when the recovery clock begins.
Plan
Service / business owner:
Exercise lead / participants and roles:
Exercise type: tabletop discussion / walkthrough of the written procedure / functional restore into an isolated environment / full failover of the live service
Recovery time objective: Recovery point objective:
Where the objectives came from and when the business owner last confirmed them:
Scenario / authorized environment:
Backup or replica used, its location, and its age at the start:
Dependencies required for the service to be usable (identity, network, DNS, licenses, encryption keys, integrations):
Representative transaction:
Abort criteria and rollback if the exercise itself causes harm:
Milestones
| Milestone | Timestamp | Evidence / limitation |
|---|---|---|
| Interruption begins | ||
| Interruption detected | ||
| Recovery authorized | ||
| Restore starts | ||
| Data available | ||
| Dependencies available | ||
| Business transaction accepted | ||
| Users informed that service is usable |
Checks
| Check | Expected | Observed | Pass / fail / untested |
|---|---|---|---|
| Restored data age | |||
| Integrity / representative contents | |||
| Identity and permissions | |||
| Encryption keys and secrets available without the primary environment | |||
| Restore source was a copy isolated from the primary environment (offline, immutable, or separate account) | |||
| Written procedure and contact list were reachable without the primary environment | |||
| Business transaction | |||
| Integrations and scheduled jobs | |||
| Time objective | |||
| Point objective |
Manual interventions / missing instructions:
Steps that depended on one specific person:
Unmet objective, owner, and retest:
Close-out
- [ ] Test copies are retired or retained under the approved plan.
- [ ] Temporary access is removed.
- [ ] Normal protection and monitoring are confirmed.
- [ ] Procedure updated with what was learned; version and date recorded.
- [ ] Results shared with the business owner and, where relevant, the people who ask for them in due diligence.
| Finding | Improvement | Owner | Due date / retest |
|---|---|---|---|
Common failure modes
- The backup restores but nobody can sign in because identity was not part of the scenario.
- Objectives were set by the technical team and never confirmed by the business owner.
- The exercise is announced, rehearsed, and run by the one person who built the system.
- A pass is recorded for a tabletop as if it were a functional restore.
Bounded conclusion and acceptance (state the exercise type in the conclusion):
Next exercise date / trigger (vendor change, major upgrade, new dependency, staffing change):
This scorecard covers one service and one scenario. It does not establish firm-wide continuity; repeat it per Tier 1 service and vary the scenario.