Backup Restore Drill SOP

Backup Restore Drill SOP
A backup you've never restored is a guess. Test the recovery, not the backup.

— Step 1: Confirm backups cover files AND database, stored off the production host.
— Step 2: Verify encryption at rest and a retention window of at least 30 days.
— Step 3: Restore last night's backup to a throwaway staging box — full dry run.
— Step 4: Check the restored site loads, login works, and the latest content is present.
— Step 5: Time the restore. If you don't know your recovery window, you don't have one.
— Step 6: Confirm one backup copy is immutable so ransomware can't encrypt it.

Do this quarterly and after any major change.
Run this every time.