[Maya Chen]

A statement that data is backed up does not prove that the service can recover within the buyer’s required timeframe. What should be tested?

[Marcus Reed]

Accepted answer

Define recovery time, acceptable data loss, systems and data covered, backup frequency, geographic and account separation, encryption, retention, deletion, and restoration responsibilities. Ask for recent restore-test evidence and how partial or corrupt data is handled. Align the contract and continuity plan with service criticality. The NIST Cybersecurity Framework includes recovery outcomes as part of cybersecurity risk management.

[Author]

Posts