Chapter 7 of 12 · Annually
Q7: Can We Recover, and How Long Would It Take?
- Do our backups actually work?
- How long could we be down?
Many companies have backups. Fewer have proved they can restore from them under pressure, and fewer still have checked that an attacker inside the network could not delete them too.
What you should hear
- The date of the last full restore test of an important system, and whether it succeeded.
- How long that restore took, compared with how long the business could cope.
- Whether some backups are kept where an attacker with admin access could not reach them.
Red flags in the answer
- "Backups run every night" with no mention of a restore test.
- Recovery time estimates that have never been tested.
- Backups managed with the same accounts as the systems they protect.
The question you might not ask out loud
Isn't this an IT question rather than a security question?
It is both. In many ransomware cases, whether the company recovers quickly depends on whether its backups survived. The CISO should be able to tell you.
Follow-up
"If our main systems were encrypted tonight, what would be working by Friday?"
Why this matters: when prevention fails, recovery is what decides whether an incident is a bad week or a crisis for the company. It is also one of the few security questions with a clear, testable answer.
Ask what would be restored first and who decided that order. Restoring everything at once is rarely possible. The order should follow the business priorities from Q1, agreed in advance rather than argued about during an outage.
Rule of thumb:A backup you have never restored is a hope, not a control.