
Verified recovery
Test clean backups and key customer journeys after restoration. Set monitoring and ownership for later signs of recurrence. Check that a visitor can find the next action without guessing.
Review accounts, permissions, authentication, unused software, and public interfaces. Remove access that no longer serves a business need. Document recurring costs and the person who controls each account.
- A written brief
- Named responsibilities
- Agreed review points




