A one-page run-sheet for a recovery drill, useful without reading anything else on this site. Print it from your browser; the page is laid out to print cleanly. It lists what to settle before, during and after an exercise, and it says nothing about your systems: it is a list of things to check, not a record that any have been done.
Before the day
- Written hypothesis: who restores what, from which backup, into where, using which runbook, to what recovery point, within what time.
- Service named, with a written “recovered” condition that someone can observe (a named user completes a named action).
- Scope small enough to finish: one service, a handful of systems.
- Restore target is isolated: no route to production, no duplicate hostname or address, no live integrations that can send mail, call webhooks or take payments.
- Real backups protected: the restore reads from them and never deletes, prunes or runs maintenance against them.
- Roles assigned: lead, scribe, operator, verifier (not the operator), plus a business owner if possible.
- The operator is not the person who wrote the runbook.
- Baseline captured: row counts, file counts or checksums to compare against.
- Abort condition written, and one person named who may call it.
- Evidence list agreed: which timestamps, identifiers and outputs will be recorded, and where the record will be stored.
During the drill
- Scribe starts the log and the lead declares T0 aloud.
- Restore point recorded as an identifier plus the time of the data it represents.
- Every step done from the runbook as written; every deviation marked in the log as it happens.
- Waiting time logged: for people, credentials, approvals and transfers.
- Each system verified individually, then the whole service verified by the verifier against the written condition.
- Restore order matches the documented dependency order, or the difference is noted.
- Output and screenshots saved with secrets and personal data redacted.
- Lead stops the clock and states the elapsed time.
After the drill
- Restored copies and temporary access removed, following your own data-retention rules.
- Log tidied and stored where it will survive your scenario.
- Measured time compared with the target RTO; measured recovery point compared with the target RPO.
- Review meeting held within a few days, run as blameless.
- Each finding has one named owner, a due date and a way to verify the fix.
- Retest scheduled for the findings that blocked or slowed recovery.
- Summary states what kind of exercise it was and what was not tested.
The reasoning behind each line is in designing a recovery drill, restore testing and the after-action review guide. To generate a plan with scope, scenario and roles filled in from your answers, use the drill planner.