Build an isolated restore sandbox before you ever need it

Build an isolated restore sandbox before you ever need it
Restoring straight onto prod to "test" is how you overwrite the survivors. Setup:
— Stand up a network-isolated box, no path back to production
— Block its outbound access so a restored, infected backup can't phone home
— Restore there first, ALWAYS, then inspect before promoting
— Keep it disposable, nuke and rebuild after each drill
— Document the promote step for the real emergency
People who restore on prod to save time end up with zero good copies. Fight me in the comments.