Incident guide · Resilience
Building ransomware-resilient backup and tested recovery
Recovery design for a small organisation with cloud files, Microsoft 365 and one line-of-business system.
What has happened
The starting point
A growing organisation relies on Microsoft 365, cloud file storage and a hosted operational system. Backups report success, but no one has tested a clean business recovery or confirmed who can restore when the usual administrators are unavailable.
Immediate concerns
- Prove restoration rather than trust job status
- Separate backup control from normal administration
- Prioritise minimum viable operations
- Keep tests proportionate to a small team's capacity
Recovery direction
Critical information and configuration have protected recovery copies, named owners, documented recovery objectives and successful clean restoration tests that business users validate.
The response path
- 01
Business impact map
Rank services, data and dependencies for the first day, first week and normal operation and approve recovery objectives.
- 02
Protection map
Document copies, frequency, retention, deletion control, administration, monitoring and provider dependencies.
- 03
Clean restore test
Restore selected user accounts, shared information and system dependencies to an isolated destination and record time and errors.
- 04
Recovery rehearsal
Walk decision-makers through isolation, clean access, restoration order, validation and return to service.
Decisions during the incident
- What constitutes minimum viable operation
- Which copies require separate administration or immutability
- How much data loss and downtime are acceptable
- Who validates restored business information
Recovery checks
- Recovery objectives are approved by business owners
- Backup administrators and recovery credentials are protected
- The chosen clean restores succeed
- A user verifies that restored data supports real work
Records to retain
- Business recovery map
- Backup and control register
- Restore evidence pack
- Recovery runbook and review calendar
- Administrator-outage rehearsal record