The useful question is not “Do we have backups?” It is “Can the business recover this named process in the time it can afford to be down?” The answer needs an owner and evidence.
For every critical system, request
- The business process that depends on it and the accountable business owner.
- The last completed restore test, date, result, actual recovery time, and limitations.
- The recovery point: how much recent data could be lost under the tested scenario?
- The location of backup copies and whether an outage, ransomware event, or administrator error could reach them.
- The dependencies required to restore: identity, network, vendor support, licensing, integration, documentation, and people.
- The manual workaround, if any, and how long it remains safe and viable.
- The incident decision path for shutting down, recovering, communicating, and resuming operations.
Watch for weak evidence
| Weak answer | Stronger evidence |
|---|---|
| “Backups run nightly.” | A dated restore test with recovered scope and actual elapsed time. |
| “Our provider has it covered.” | Named owner, contract responsibility, escalation path, and tested handoff. |
| “We can work manually.” | Documented workaround, capacity limit, controls, and maximum sustainable duration. |
| “The system is cloud-based.” | Business-continuity plan for identity, integrations, exports, vendor outage, and local operations. |
Turn test results into a business decision
Ask IT or the provider to demonstrate a restore and record the actual elapsed time. Ask operations whether the restored process could produce, ship, and reconcile real work. A database that starts successfully may still leave ERP interfaces, labels, recipes, or quality records unavailable.
Set a recovery time objective (RTO): the longest acceptable time before the system is restored. Set a recovery point objective (RPO): the maximum tolerable amount of recent data loss. Business owners set tolerance; technology owners show whether the design and last test meet it. NIST’s contingency-planning guide explains these measures.
| Example | Evidence needed | Decision owner |
|---|---|---|
| ERP unavailable during shipping | Restore time, order backlog, manual release controls | Finance and operations |
| Production file or recipe lost | Last recoverable version, integrity check, equipment dependency | Plant and engineering |
| Identity or network outage | Ability to access backups, vendor contacts, alternate path | IT and operations |
Where insurance fits
Have the broker identify policy reporting deadlines, approved incident-response resources, retention, waiting periods, and the evidence needed for a business-interruption claim. Have finance retain time-stamped records of shutdown, recovery expense, lost or deferred orders, and mitigation. Coverage depends on policy wording and facts; the recovery plan must work even if a claim is delayed or denied.
CISA recommends regularly testing backups, including copies protected from ransomware. Ask when the test was run, what was restored, and what failed.