Could the business keep trading through a serious disruption?

What the 15 questions cover

• Recovery Testing Reality

  In the last 12 months, has a full restore from backup actually been performed — not just confirmed the backup file exists? Was the most recent restore test done under realistic time pressure, as if it were a real outage? Was the most recent restore test performed by someone other than whoever originally configured the backup?

• Recovery Time / Point Clarity

  Is there a documented Recovery Time Objective (maximum acceptable downtime) for your most critical system? Has that Recovery Time Objective actually been tested against, rather than just estimated? Is there a documented Recovery Point Objective (maximum acceptable data loss) that matches how often backups actually run?

• Single Points of Failure

  If your sole IT lead or system administrator became unavailable tomorrow, could someone else restore operations within a day? Is there a single vendor whose outage would stop your business, with no documented fallback? Is there a single system whose failure would halt more than one critical business function?

• Incident Response Readiness

  Does your incident response plan name who declares an incident, who they contact, and in what order? Has anyone who would actually use the incident response plan read it in the last 12 months?

• Communication Continuity

  If your main system was down for 48 hours, do customers have a way to find out what's happening that doesn't depend on that same system? Do staff have an alternate way to communicate with each other and leadership if email or the main system is unavailable?

• Vendor & Third-Party Continuity

  Do your vendor contracts require the vendor to maintain their own backups and continuity controls? Has anyone actually verified a key vendor's continuity claims, rather than just assuming they hold?