SAMPLE-BKP-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Backup and Recovery Readiness Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Backup coverage and restore evidence for a fictional business: Microsoft 365, 12 Azure VMs and 6 on-premises servers.
Executive summary
Backups run and mostly succeed, but recovery is unproven. The only restore test was a single file, the on-premises backup server is reachable from ordinary workstations, there is no offline or immutable copy, and Microsoft 365 has no separate backup.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Backup job success report, 30 days | On-premises product | Provided |
| E-02 | Azure Backup vault report | 12 VMs | Provided |
| E-03 | Microsoft 365 retention settings | Mail and files | Provided |
| E-04 | Recovery document | 1 document, last edited 2024 | Provided |
| E-05 | Restore test log | Last 12 months | Provided: one file-level restore |
| E-06 | Backup configuration screenshots | Console access and accounts | Provided |
What was not checked
- Application-level consistency of database backups
- Third-party SaaS data
- Physical security of offsite media
- Actual restore speed
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | No immutable or offline copy of on-premises backups | E-01 | Add an immutable or offline copy and keep it out of reach of the domain. |
| F-02 | High | Only one file-level restore test in 12 months; no full-system test | E-05 | Schedule and record a full-system restore in an isolated environment. |
| F-03 | High | No separate backup of Microsoft 365 data | E-03 | Decide on a backup option for mail and files and set retention. |
| F-04 | Medium | Backup console reachable from workstations; single shared admin account | E-06 | Restrict access, use named accounts with MFA. |
| F-05 | Medium | Recovery document is out of date and has no restore order | E-04 | Rewrite with identity first, then critical systems, and keep an offline copy. |
| F-06 | Low | Failed-job alerts go to a mailbox nobody monitors | E-01 | Send alerts to a monitored queue with an owner. |
Fix first
- Add an immutable or offline copy Effort: Medium.
- Run a full-system restore test Effort: Medium.
- Choose and set up Microsoft 365 backup Effort: Medium.
- Lock down the backup console and accounts Effort: Low.
- Rewrite the recovery runbook Effort: Low.
30/60/90-day plan
- First 30 days: Fix alert routing; lock down the console; start the runbook rewrite with identity first.
- By 60 days: Add the immutable copy; run the first full-system restore test.
- By 90 days: Decide on Microsoft 365 backup; repeat the restore test for a second system; schedule quarterly tests.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.