💾 A backup that has never been restored is a hypothesis. This kit turns it into four signed numbers in 45 minutes: the drill agenda, the restore log that doubles as audit-prep evidence, the 3-2-1-1-0 self-check, and the quarterly rotation planner. Supports recovery-readiness and audit-prep workflows — a practical starting point to review and adapt for your organization; not legal, compliance, or audit advice, and not a substitute for professional disaster-recovery services.

How to use this (5 steps)

  1. Duplicate this page into your workspace (top-right).
  2. Schedule 45 minutes + an operator + a scribe. That's the team.
  3. Pick the target BEFORE you feel ready — one production system that would hurt Monday morning.
  4. Run the drill, then fill the Restore Log — four numbers and a signature.
  5. Book next quarter's re-run with a different target. The rhythm is the control.

The 45-minute agenda

Clock Step
0:00 Pick the target before you feel ready: file server, finance share, the PSA/RMM database. Not the easy one.
0:05 Restore last night's copy to an ISOLATED target — spare VM, empty VLAN, cloud sandbox. NEVER over production. No internet egress required.
0:35 Verify like a USER, not an admin — open 3 files · run 1 report · log in with a real non-admin account. "It boots" is not "it works."
0:40 Log four numbers — minutes to restore · GB restored · items verified · today's date. Scribe signs the page.

✅ The one rule: every claim gets a NUMBER and a DATE. "Restores work fine" is a mood; "47 minutes, 212 GB, 3 files opened, signed Aug 11" is evidence — the artifact cyber-insurance applications and enterprise questionnaires reach for when they ask about tested recovery. (Numbers above are format examples, not benchmarks.)

Restore Log (duplicate this block per drill)

RESTORE TEST LOG
Date: ______________   Operator: ______________   Scribe: ______________
Target system: ____________________  Backup timestamp used: ____________
Restore destination (isolated): ________________________________________
Started: ______  Data usable at: ______  MINUTES TO RESTORE: ______
GB RESTORED: ______        Restore throughput (GB ÷ min): ______
VERIFIED LIKE A USER (all three or it doesn't count):
  [ ] 3 files opened and readable     [ ] 1 report/app function ran
  [ ] Non-admin account logged in
ITEMS VERIFIED: ______
Result:  [ ] PASS   [ ] FAIL → gap logged below (a failed test is a finding)
Gap found / owner / fix-by date: _______________________________________
Scribe signature: ______________

File every log — passes AND fails. The paper trail from red to green is itself evidence of a functioning program.

3-2-1-1-0 self-check

A commonly used rule of thumb — adapt to your environment.