Backup and Restore-Test Policy Builder
List your systems with RPO, RTO, backup frequency, immutable and offline copies and the last restore test. The calculator flags every system that cannot meet its RPO, has no immutable copy or has not been restored in 6 or 12 months, and the policy text and controls are ready to edit.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
List your systems with their recovery point and recovery time objectives, how often they are backed up, whether an immutable and an offline copy exist, and when a restore was last tested. The calculator flags every system whose backups cannot meet its RPO, has no immutable copy, or has not been restored within 6 months (Tier 1) or 12 months (others). Then edit the policy text and record which control requirements are in place.
Your context
Systems, recovery targets and backup status
One row per system or data set. RPO is how much data you can afford to lose; RTO is how long you can be down. Hours throughout. Last restore test as YYYY-MM-DD.
Control requirements
What the policy commits the organisation to. Mark how far each is in place today.
At least three copies of critical data, on two different media or platforms, with one copy off-site and one copy immutable or offlinematerial
Backup systems use separate administrative accounts, with MFA, not joined to the main domainmaterial
Backup frequency for every system meets its agreed RPO
Restore tests: Tier 1 at least every 6 months, all other tiers at least every 12 months, with results recorded against the RTOmaterial
At least one full-environment recovery exercise per year, including identity (Active Directory or equivalent) restored first
SaaS data (email, files, CRM) is covered by a backup the organisation controls, or the decision not to back it up is recorded
Restores after a cyber incident go to an isolated, clean environment and are scanned before reconnection
Backup job failures, deletion attempts and retention changes alert the security team, not just IT operations
Backups are encrypted in transit and at rest, with keys held outside the environment being backed up
Recovery runbooks exist for each Tier 1 system, with the restore order and dependencies, and are stored where they survive an outage
Policy text
Edit the sample wording to fit your organisation.
What this template gives you
- Backups you have never restored are a hope, not a control. Ransomware groups also go after backups first.
- The calculator checks each system: backup frequency against RPO, immutable copy, offline copy, restore test age (6 months for Tier 1, 12 for others) and the last test result.
- It also counts how many Tier 1 systems are fully recoverable: backup meets RPO, immutable copy, recent test, restored within RTO.
- Ten control requirements (3-2-1-1-0 copies, separate backup admin accounts, clean-room restores after an incident, identity restored first) and seven policy sections are ready to edit.
Frequently asked questions
How often should backups be restore-tested?
A common, defensible standard is at least every six months for critical (Tier 1) systems and every twelve months for the rest, plus one full-environment recovery exercise a year that restores identity services first. A test means restoring to a working system and checking the application, timed against the RTO.
What is the 3-2-1-1-0 backup rule?
Three copies of the data, on two different media or platforms, one off-site, one immutable or offline, and zero errors when restores are verified. The immutable or offline copy is what survives an attacker who has taken over your administrator accounts.
Why does the RPO check matter?
If a system's RPO is one hour but it is backed up every four hours, you can lose up to four hours of data, which breaks the promise made to the business. The calculator compares the two for every row.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.