Data Nexus
Express Audit
Menu

Check · 40 minutes · 6 questions

“We have backups. Everything is backed up nightly.”

Ask for these first

In writing, before the meeting. The request is half the check: everything below is one line to supply if it exists.

The date of the last full restore, and what it was restored into
The only question that separates a backup from a hypothesis. A team that cannot answer it does not know whether it has backups; it knows it has jobs reporting success.
The interval between copies, and where they are stored
The interval is the RPO whatever the policy says. Where they are stored decides whether they survive the event that takes the original — a copy under the same credentials is a second copy of the risk.
The list of what is included, checked against the asset register
Databases are usually covered. Uploaded files, mail, the payment gateway configuration, DNS, the CI secrets and the analytics history usually are not, and each is discovered missing during the restore.
Who is authorised to declare an incident, and their number
Detection and decision are two of the four terms of a real recovery time and are the two nobody rehearses. At 02:00 on a Friday this is a phone tree, and its absence is measured in days.
01/The questions
  1. 01

    When did somebody last restore from a copy, into what?

    Restoring proves the copy is complete, the format is readable, and the environment to receive it still exists. Nothing else proves any of those.

    If instead“The backups run every night and we get the success emails.” That is a statement about a job, not about a copy.

  2. 02

    How long did that restore take, start to finish?

    The measured figure, not the estimate. The estimate contains only the restoration term and omits detection, the decision, and verifying the result is correct rather than merely running.

    If insteadThe number is quoted with confidence and has never been timed. Ask when the stopwatch was started and by whom.

  3. 03

    Where do the copies live, and under whose credentials?

    A copy in the same account as the original does not survive the compromise of that account, which is the ordinary shape of a ransomware event rather than an exotic one.

    If insteadSame cloud account, same console, same login. Or nobody knows, which is the same answer.

  4. 04

    What is not in the backup?

    Read the list against the asset register rather than against memory. Files, mail, DNS, gateway configuration and secrets are the usual absentees, and each one turns a restore into a partial one.

    If instead“Everything.” Nothing covers everything, and a supplier who says so has not checked.

  5. 05

    How many hours of work can the business lose?

    Ask the owner, not the engineers, and in their own units — orders, records, messages. That answer is the RPO, and everything technical is downstream of it.

    If insteadThe interval was chosen for operational convenience and the business has never been asked. In most companies the honest answer is far shorter than nightly.

  6. 06

    Rehearse it, unannounced, and time all four terms.

    Detection, decision, restoration, verification. Teams are reliably wrong about the total and the error is always in the same direction.

    If insteadResistance to rehearsing on the grounds that it is risky. A recovery nobody dares rehearse is a recovery nobody should rely on.

02/What the answers mean
It is real
A dated restore, a timed one, copies held under separate credentials, a list checked against the register, and an RPO the owner recognises as their own decision.
It is not
No restore has been performed. Everything else is unknown at that point — completeness, readability, duration and whether the receiving environment still exists — and the correct description of the position is that the business is uninsured and believes otherwise.
Cannot tell
Restores happen and nobody has timed the whole sequence, or the copies are sound and sit beside the original. Both are real gaps with known fixes, and neither means the work so far was wasted.
03/Where we failed it

Our own deployments, July–August 2026

This site failed to deploy for six consecutive days and nobody noticed. A pattern in .gitignore without a leading slash matched a directory at any depth, so a build input stopped being committed and every build after it failed — while production kept serving the last good version, which is exactly why it was invisible. We were monitoring whether the site was up. Nothing was watching whether what was live was what we had written.

SinceAugust 2026. There is a /version endpoint carrying the commit and build time, and `npm run check:deploy` compares local HEAD against it and fails loudly when they differ. The class of failure was detection rather than recovery, which is the term this check spends the most time on for exactly that reason.

The words this uses
Recoverable copy
A copy somebody has restored from. Until then it is a hypothesis, and the word backup is what the hypothesis is called before it is tested.
RPO
How much recent work you have decided you can afford to lose — expressed in time, and settled by the business rather than by the infrastructure.
RTO
How long you have decided the business can be down — and the only version of the number worth having is one somebody has timed.
Data reconstruction
Rebuilding what the system knew from whatever survived it — the discipline that exists because the copy you were counting on is the thing that failed.
Failure isolation
How much stops working when one thing stops working — a property you design in, and discover the value of exactly once.
Least privilege
Giving each person the narrowest access that lets them do their job, so that a compromised or departing account costs the least it can.
Digital asset register
A written list of every account, domain and system the business depends on, recording who owns it, who administers it, what it costs and how it is recovered.

Every checkThe whole glossary

Next

A supplier who cannot supply a base and a period has told you something, and it is not that they are disorganised. We do this for a living and the questions land differently when they come from outside.

Express auditTalk to us