01Start with business-critical work
List the tasks that stop if important systems or information become unavailable. Map the applications, data, credentials and suppliers needed to restart them. This reveals dependencies that a simple file-backup list can miss, such as email access used for account recovery.
Agree recovery time and recovery point objectives in terms the business understands. These describe the desired restoration window and acceptable data loss; they are not guarantees supplied by this page. Achievable targets depend on the environment, backup design and available resources.
02Define the backup scope
Confirm which databases, documents, configuration and other records are included. Identify exclusions and retention arrangements. Consider separation from production access so that a single compromised account does not expose every copy. The appropriate storage and access controls depend on the information involved.
Check failure notifications and ownership. A scheduled job can fail silently if nobody receives or investigates the alert. Record how the team verifies that expected copies exist and can be accessed by an authorised responder.
03Test a restoration
A meaningful test restores representative information or a system into a safe environment and checks whether it is usable. Document the steps, time taken, missing dependencies and any difference from the intended objective. Testing only whether a backup file can be downloaded leaves important questions unanswered.
Include an alternative route to necessary credentials and contacts. A plan stored only inside the unavailable system is difficult to use during an incident. Keep the controlled recovery instructions available to the appropriate people.
