The useful question is not “Do we have backups?” It is “Can the business recover this named process in the time it can afford to be down?” The answer needs an owner and evidence.
For every critical system, request
- The business process that depends on it and the accountable business owner.
- The last completed restore test, date, result, actual recovery time, and limitations.
- The recovery point: how much recent data could be lost under the tested scenario?
- The location of backup copies and whether an outage, ransomware event, or administrator error could reach them.
- The dependencies required to restore: identity, network, vendor support, licensing, integration, documentation, and people.
- The manual workaround, if any, and how long it remains safe and viable.
- The incident decision path for shutting down, recovering, communicating, and resuming operations.
Watch for weak evidence
| Weak answer | Stronger evidence |
|---|---|
| “Backups run nightly.” | A dated restore test with recovered scope and actual elapsed time. |
| “Our provider has it covered.” | Named owner, contract responsibility, escalation path, and tested handoff. |
| “We can work manually.” | Documented workaround, capacity limit, controls, and maximum sustainable duration. |
| “The system is cloud-based.” | Business-continuity plan for identity, integrations, exports, vendor outage, and local operations. |
Question from finance leadersWhat is the cost of relying on a recovery assumption that has never been tested? Start by measuring the business interruption exposure, then prioritize the systems with the largest consequence.