How do we show an auditor or an insurer that our backups restore?

Start

An auditor or insurer asks you to show that your backups restore

A backup job that finished says only that it wrote something. It does not show that the data restores, restores in time, or comes from a copy an attacker with your administrator credentials could not have deleted. So the proof is a record of restores: what was restored, from which copy, how long it took, whether the data was whole, who checked it and what failed.

• Then: Has each critical data set had a restore test that restored a backup?

Decision

Has each critical data set had a restore test that restored a backup?

Only a restore test can be reported. A tabletop, a drill, or a supplier's failover that restores none of your backups is not a restore test and is never counted. Data a provider holds with no copy of yours is tested through the provider's own recovery test. If you cannot name the test for a data set, answer no.

• No, or not known: Run the missing restore tests, and list each gap in the report
• Yes, every one: Keep the eight-item evidence record for every test

Outcome

Run the missing restore tests, and list each gap in the report

A report cannot show a test that was not held. List each data set with no restore test under what was left out, with the date its test is planned. Choose the test type for each data set, date it, and tell the data owner and the backup supplier. Then come back to this question with the results.

Step

Keep the eight-item evidence record for every test

Each test leaves a record with eight items: the data set and the copy used, the integrity check on the copy before the restore, start and end times from system logs, what was restored and what it was compared with, the application's own consistency check, the data lost, who ran, checked and confirmed it, and every failed criterion with its finding.

• Then: Could someone who was not there rebuild each test from its record?

Decision

Could someone who was not there rebuild each test from its record?

That is the auditor's position. Take one test and read only its record. Can you see what was restored, from which copy, when it started and ended, the checks made and who made them? Times must come from system logs, not memory. If any test fails this, or you have not tried it, answer no.

• No, or not known: Fill gaps from logs; where you cannot, TC-06 is not met
• Yes, from the record alone: Did someone other than the tester check each result?

Step

Fill gaps from logs; where you cannot, TC-06 is not met

Pull start and end times, copy identifiers and check results from system logs and the backup console. Do not reconstruct from memory. Where an item cannot be recovered, the evidence criterion (TC-06) is not met for that test, and the report says so with a finding. The evidence list says where each item is kept and which role holds it, somewhere reachable when the main systems are down.

• Then: Did someone other than the tester check each result?

Decision

Did someone other than the tester check each result?

The restore checker compares the restored data with its source or a sample and runs the application's own consistency check. The data owner opens records that matter and confirms the data is usable. A restore checked by the person who ran it is weak evidence. If you are unsure who checked, answer no.

• No, or not known: Get an independent check, or record the criterion as not met
• Yes, someone independent: Judge each test against the six criteria and record pass or fail

Step

Get an independent check, or record the criterion as not met

Where the data can still be checked, have someone other than the tester check it with the data owner. In a small team that can be a person from another team, or the supplier. Where it cannot, record the independence criterion as not met in the report. Never mark a test as passed on the tester's own word.

• Then: Judge each test against the six criteria and record pass or fail

Step

Judge each test against the six criteria and record pass or fail

The six criteria are restore completed, integrity checks passed, time within the recovery time objective, data lost within the recovery point objective, checked independently and confirmed, and evidence recorded. A test passes only when every criterion holds. Time and data lost apply only to timed tests, and the report says so where they do not apply. Do not average the criteria or write that a test mostly passed.

• Then: Did every test meet every criterion?

Decision

Did every test meet every criterion?

Count the criteria that applied and the tests that failed one. A test that misses any criterion has failed, and the report leads with that. If a criterion has not been assessed, treat it as not met until it is.

• No, or not known: Raise a finding for every miss, with an owner, severity and date
• Yes, every criterion met: Show the restore time beside the cyber recovery time

Step

Raise a finding for every miss, with an owner, severity and date

Every failed criterion is a finding with an owner, a severity and a due date. By the pack's defaults the owner agrees a plan within 10 working days, and a High finding is fixed within 90 days, a Medium within 180 and a Low within 365. A finding closes only when a retest or new evidence shows the fix works. A finding that is also an objective gap is linked to it and keeps the date the gap sets.

• Then: Show the restore time beside the cyber recovery time

Step

Show the restore time beside the cyber recovery time

A restore in normal conditions shows how long the restore takes with the tools you have. It does not show recovery after a destructive attack, when the foundations are rebuilt first. For each critical service, show its recovery time objective, the time the last test achieved and the cyber recovery time, taken from the recovery objectives matrix. A service never tested says Not tested, not a guess.

• Then: Has the immutable or offline copy been restored too?

Decision

Has the immutable or offline copy been restored too?

A restore from the online copy says nothing about the immutable or offline copy, and the reverse. For a critical data set, alternate between them at each test and record which one was used. If the report does not say which copy each test used, or you are not sure, answer no.

• No, or not known: Name the copy not tested and test it at the next restore
• Yes, both copies restored: Does a supplier run any of the backups or hold in-scope data?

Step

Name the copy not tested and test it at the next restore

Say in the report which copy was not restored and what a reader might wrongly conclude from that. Plan the next test of the data set from the other copy. If no copy is out of reach of production administrator credentials, that is a protection finding of its own.

• Then: Does a supplier run any of the backups or hold in-scope data?

Decision

Does a supplier run any of the backups or hold in-scope data?

Where a supplier runs the backup, ask for its own restore test results and its restore time. The pack asks that the contract give a restore time no longer than the service's recovery time objective. The report is still yours: sign it, and say what you relied on the supplier for. If you are not sure who holds a copy, answer yes.

• Yes, or not known: Attach the supplier's restore results and say what you relied on
• No, we run them all: State what the tests did not show

Step

Attach the supplier's restore results and say what you relied on

Attach the supplier's results to the evidence list and record the supplier's restore time against the service's objective. A contract that gives no restore time, or a longer one, is a failed check and a finding. In the limits section, name what you relied on the supplier for.

• Then: State what the tests did not show

Step

State what the tests did not show

Answer six questions: where it was restored, which copy was used, whether it was timed, what it did not cover, what it relied on, and how independent the checker was. A report that claims no limits is one a careful reader will doubt. A limit explains what a reader might wrongly conclude and what would remove the doubt. It is never an excuse for a failure.

• Then: Write the nine-section report, leading with what failed

Step

Write the nine-section report, leading with what failed

Use the report's nine sections: summary, scope, method, evidence list, results by criterion, times against objectives, findings, limits and sign-off. The summary leads with the failures and uses counts such as 3 of 5, never a share, a grade or a colour. By the pack's defaults a test report is issued within 10 working days of the test.

• Then: Get four signatures, the checker not being the tester

Step

Get four signatures, the checker not being the tester

The tester, the restore checker, the data owner and the backup owner each sign their own statement, with a date. The rule requires only that the checker is not the tester. The template asks for four different people, so where one person holds two roles, say so and why. The backup owner signs last, after reading the findings. If fewer than four sign, the report says why and who will sign.

• Then: Answer the usual questions, pointing to the section for each

Step

Answer the usual questions, pointing to the section for each

The template lists the usual questions, and each points to the section that answers it: what was restored and from which copy, how long it took, whether the data was whole, whether it met its time and data-loss limits, who checked it, what failed and what the report does not show. Keep the signed copy unchanged, classify the report as you do other security assessments, and give the underlying logs when asked.

• Then: Give it as evidence, then report quarterly and keep it for the period

Outcome

Give it as evidence, then report quarterly and keep it for the period

The report is evidence and not a claim of compliance. Whether a given auditor, insurer or supervisor accepts it is theirs to decide. Report the test counts to executive management each quarter and to the approver each year, as counts with every gap named. By the pack's defaults, keep the records for 3 years, or longer where law or a contract asks.