Recovery tests include people and permissions
A recovery test that only proves the data comes back has tested the easy part.
The real test includes whether the people who need to do it are available and know how, whether their access still works, whether the documentation matches reality, and whether anybody can reach the systems when the usual authentication is down. Those are the things that actually add days to a real recovery.
More on Backups and recovery
- Offline copies break attacker reachabilityReach ends at the last plug
- Immutable backups trade flexibility for protectionSet in concrete
- RPO and RTO answer different questionsTwo different clocks
- Restoring data can restore malware tooThe newest jar is the spoiled one
- Backup credentials deserve separate protectionNot on the same switch
- Recovery order follows dependenciesBottom crate first