
Verified recovery
Test clean backups and key customer journeys after restoration. Set monitoring and ownership for later signs of recurrence. Check the destination as well as the message that sends people there.
Review accounts, permissions, authentication, unused software, and public interfaces. Remove access that no longer serves a business need. Keep essential access separate from an individual employee's login.
- A written brief
- Named responsibilities
- Agreed review points




