DAILY ANALYSIS
How to verify your backups can recover a service after ransomware
Run an isolated restore drill that measures recovery time, checks data integrity, and confirms that the application works.
Who is affected
Backup operators and service owners need to know whether they can recover when production systems and accessible backups are unavailable. CISA recommends keeping encrypted backups offline and regularly testing their availability and integrity. A successful backup job records a copy operation. A recovery drill shows whether the team can use that copy.
What to do first
Pick one critical service and record its recovery time objective and acceptable data loss. Inventory the database, application configuration, deployment artifacts, and the access needed to recover them. Confirm that the recovery team can retrieve the offline copy and unlock it using the approved recovery procedure. Agree on how incident responders would select a last known good point if the incident start time were uncertain.
How to verify the result
In a hypothetical order system drill, the recovery team restores into an isolated environment with outbound customer notifications disabled. An operator compares record counts and sampled order totals with a trusted record from the selected recovery point. The service owner then runs a synthetic order through the recovered application. Record the recovery point, elapsed time through application acceptance, discrepancies, and the people who validated the result.
Investigate failures before the next drill
A restored database may be usable while the service still fails because a dependency, configuration, or recovery credential is missing. Assign an owner to each failure and repeat the affected steps. Include the time spent retrieving backups and recovering dependencies when comparing results with the service target.
What the drill establishes
The evidence applies to the selected backup, service, and exercise conditions. During a real incident, use incident evidence to assess when corruption began and which recovery points remain trustworthy. Track possible data exposure through incident response even when the restored service works.