Plan a recovery rehearsal that checks data, dependencies and a useful workflow—not simply a successful backup console message.
Define the result before starting
Choose a representative service and agree what a useful recovery would look like. Identify the business owner who will validate the result. A test needs clear boundaries: the recovery point, environment, permitted changes and what remains outside scope. Without those boundaries, a successful technical step can be mistaken for a complete recovery.
Prepare an appropriate test environment
Agree how the restored workload will be isolated and which connections it needs. Consider network routes, identities, integrations and any risk of sending duplicate notifications or transactions. Production access and changes should be separately authorised. An isolated environment may reduce disruption, but its differences from production must be recorded when interpreting the result.
Include the steps before data transfer
Measure the time needed to find the right recovery point, obtain authorised access, retrieve keys and prepare infrastructure. These steps are part of readiness. If one person holds undocumented knowledge, record that dependency. A repeatable runbook should support the designated team rather than rely on somebody remembering the last recovery attempt.
Validate a representative workflow
Check whether the restored application can complete a useful business task with the expected data. Review relevant dependencies and permissions. Reconcile a sample of records with the agreed recovery point. Ask the service owner to confirm the acceptance criteria rather than treating a login screen or an error-free startup as the final result.
Record limitations as carefully as successes
State what was tested, the conditions, elapsed stages and evidence. Include excluded integrations, reduced data volumes or alternative infrastructure. A test can be successful within its scope while leaving important questions unanswered. This is not a reason to dismiss the result; it is a reason to plan the next validation clearly.
Turn findings into owned improvements
Assign gaps to responsible people and agree how completion will be demonstrated. Update the runbook and repeat affected steps after changes. Keep the record accessible through an appropriate recovery route if the normal environment is unavailable. The value of the rehearsal comes from the decisions it improves before a real disruption.
Further reading: CISA #StopRansomware Guide.