Quick answer

A restore drill tests whether a business service can return within an accepted interruption and data loss limit. In a ransomware scenario it must also examine the recovery environment and administrative identities. The success criterion is a business transaction verified by its owner rather than a green backup job indicator.

This guide addresses planned controlled exercises. It is not an automatic replacement for decisions made by the incident response team during an active attack. The RTO and RPO planning guide covers the underlying objectives.

Why a valid backup may not restore a service

A database can be restored while its encryption key remains unavailable. The application may depend on an inaccessible identity provider. DNS or a licence service may be missing. An old service account could reconnect a recovered machine to a compromised environment.

Choose a business service as the exercise unit. For example verify that a synthetic order becomes an invoice and appears in the expected report. Record infrastructure availability separately from business acceptance.

The CISA ransomware guide recommends offline encrypted backups and regular recovery testing. It also addresses restoring prioritized services on clean networks and avoiding reinfection. The worksheet below is an original exercise proposal based on those general principles.

Define the scope before starting the clock

Name the service and its business and technical owners. Agree the maximum interruption and data loss. Define the starting event and acceptance conditions before the exercise begins.

List dependencies beyond application servers. Identity and DNS frequently support the entire workflow. Verify access to encryption keys. Include configurations and certificates. A plan may fail when its only key copy is stored on the system it needs to recover.

Use synthetic data where practical. If real backups are required define access and retention conditions. Prevent a rehearsal from overwriting production data or sending test messages to customers. The safety boundary is part of the exercise design.

Eight proposed acceptance gates

This is a DSET worksheet created for the guide. Use pass and fail and insufficient evidence as distinct outcomes. Fill in objectives for the organization. No universal recovery duration is implied.

No Gate Acceptance criterion Evidence
1 Backup and key access Authorized operator can open the selected backup Backup identity and access result
2 Recovery point selection Selection tied to the incident timeline Timeline and review summary
3 Isolated recovery environment No uncontrolled production connection Network rules and connection check
4 Identity and secret security Risky identities not copied unchanged into the clean environment Renewal and access plan
5 Data and application consistency Critical records validated at application level Sample record comparisons
6 Business process acceptance Business owner completes the agreed transaction End to end result
7 Time and data loss Observations meet previously agreed objectives Recovery and data point timestamps
8 Reconnection decision Security and business owners approve controlled return Decision and monitoring plan

Download the restore acceptance worksheet. Each gate includes fields for an owner and observations.

Worked example: two different recovery clocks

This is a fictional exercise. A service fails at 10:00. Its agreed objectives are a maximum interruption of 120 minutes and a maximum data loss of 10 minutes. Restoration begins at 10:15. The selected backup contains verified consistent application records through 09:45. The business owner accepts the service at 12:10.

The observed service interruption is 130 minutes. Counting only from the restore job start would give 115 minutes. That shorter duration does not describe the entire interruption. The agreed 120 minute objective was missed.

The observed data loss window is 15 minutes. This is the gap between the last validated recoverable point and the interruption. It exceeds the 10 minute objective. If application journals support recovery to a later consistent point recalculate using that evidence.

These numbers are not a client result or a service promise. NIST SP 800-34 Rev. 1 connects contingency planning to business impact and recovery objectives. Keep the target distinct from the measured outcome in the report.

A clean recovery point needs more than a date

The newest backup may have been captured after compromise. An older copy may omit important records. Selection therefore depends on understanding the incident. A clean malware scan does not prove the absence of attacker access.

Include a decision checkpoint. Which evidence supports the selected point? What review must finish before reconnection? If an earlier point is chosen does the business owner know which records need reconstruction? Preserve the reasoning separately from speed measurements.

Business acceptance should exercise a workflow

An ERP drill could create a synthetic order and follow inventory and accounting effects. A document service should allow an authorized user to read a file while denying an unauthorized user. A working landing page is not sufficient evidence.

Validate permissions after restoration. An older backup can restore an account that should no longer be active. A matching file hash establishes a different property from current and complete business records. Technical integrity and business correctness require separate observations.

NIST SP 800-184 addresses planning and improvement of cybersecurity event recovery. The practical application here is to turn missing dependencies and unresolved decisions into retestable actions.

Make limitations visible

Report measured duration with its starting and ending definitions. Identify the accepted data point. List dependencies that were not exercised. Do not extrapolate a small sample's restore time to the entire production estate without supporting evidence.

Name owners for corrective actions and exceptions. Changes to identity or backup infrastructure can trigger another test before the next scheduled exercise. Repeat failed gates under the same acceptance definitions after correction.

Frequently asked questions

Does an immutable backup guarantee recovery?

No. It can reduce deletion or alteration risk under defined conditions. Key access and application consistency and restoration duration still need testing.

Must the whole production environment stop for a drill?

No. Isolated and staged exercises are possible. Clearly limit conclusions to the scope actually tested.

Is opening the backup file sufficient?

No. The application and business workflow must also be validated. An accessible file can contain incomplete or outdated records.

Is acceptance solely an IT decision?

No. Technical teams validate infrastructure. The business owner accepts the workflow. Security owners evaluate reconnection conditions.

Prepare a DSET scope

Describe the critical service and backup method. Include agreed objectives where available. DSET data recovery and cybersecurity services provide starting points for discussing the relevant scope. For damaged backup media see the enterprise backup recovery guide.

Editorial note: The gates and worked calculation are original teaching material. Sources were checked on 11 October 2026. No recovery rate or fixed completion time is guaranteed.