State and recovery
Recoverable copy
A copy somebody has restored from. Until then it is a hypothesis, and the word backup is what the hypothesis is called before it is tested.
Also called Backup · Резервная копия
Almost every business has backups. A much smaller number have restored from one, and the gap between those two populations is where the expensive discoveries live: the job that has been failing silently for months because nobody reads a success email, the copy that contains the schema and not the data, the archive that restores into an environment nobody can create any more, the encrypted volume whose key was in the system that was lost.
There is also the case where the copies are working perfectly and are worthless, because they sit in the same account as the thing they protect. Whatever compromises the account reaches them too — and that is not a hypothetical failure mode, it is the ordinary shape of a ransomware event. A copy under the same credentials as the original is a second copy of the risk.
So the test is not whether copies exist. It is when the last full restore was performed, into what, by whom, and how long it took. A team that cannot answer those four does not know whether it has backups; it knows it has jobs that report success.
Monitoring watches whether the backup ran and reports green for years. It cannot see that the dump is truncated, that a table stopped being included when it was renamed, or that the restore requires a version of the database nobody runs. Schedule a restore into a scratch environment on a calendar, measure how long it takes, and check the row counts. The first one always finds something.
Not quantities. Methods, artefacts and failure modes — the absence of a formula here is the point rather than an omission.
Is an input to
- RPO
- How much recent work you have decided you can afford to lose — expressed in time, and settled by the business rather than by the infrastructure.
- RTO
- How long you have decided the business can be down — and the only version of the number worth having is one somebody has timed.
An error in this figure does not stay in it. It reaches two numbers above it, and each of those is quoted as though it were measured.
The term is a reading taken at a point in a sequence that is already running. These are the sequences, with the place each of them jams.
- From something breaking to somebody confirming it works
- An outage, from the moment the system stopped being correct to the moment a person has checked that it is correct again — including the parts that happen before anybody has touched a keyboard. 6 steps, monitoring whether the site is up is the arrangement that fails while looking reasonable.
Knowing the definition is not the same as being able to check the figure. These are the procedures that do the second thing.
- Testing a claim that you are covered
- “We have backups. Everything is backed up nightly.” · 40 minutes, 6 questions.
A definition proves nothing. These are the places on this site where this quantity was actually computed, with the period and whose figure it is stated beside each one.
Every backup the business was counting on was destroyed along with the estate it was taken from. Nobody had restored from one, so none of them was a copy — all of them were a hypothesis.
Enterprise E-commerce Recovery & Data-Driven Rebuild · 30 September 2024 · our measurement
A definition is free. Being answerable for the figure it produces is the part that is bought, and this term is a working part of the engagements below.
- M&A audit and deal review
- Price the system you are buying, not the one in the data room.
- Anti-crisis engineering and recovery
- Stabilise before you improve. A system under stress cannot absorb a redesign.
The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.