Insights · Checklist

Backup and restore validation checklist

A successful backup job proves a copy was written. This checklist proves the copy restores, within the time the business needs, from storage an attacker cannot reach, and leaves the records that make it evidence.

How to use it

Before the first step.

Validate on a schedule and after any change to backup systems or critical applications.
Record failures as well as successes; both are evidence of a working process.

Steps

Each one owned and evidenced.

#	Step	Owner	Evidence
01	Inventory the systems and data that must be backed up, from the business impact analysis.	IT lead	Backup scope list
02	Confirm every item in scope is included in a backup job with the required frequency.	IT lead	Coverage comparison
03	Confirm backup copies are stored with separate credentials, immutable or offline, and that production admins cannot delete them.	IT lead	Isolation evidence
04	Confirm encryption of backup data and secure management of the keys.	IT lead	Encryption configuration
05	Review backup job results for the period; investigate every failure and partial.	IT lead	Job result review
06	Restore a sample of files and confirm integrity against the source.	IT operations	File restore record
07	Restore a complete application or service, including dependencies, into an isolated environment.	IT operations	Service restore record
08	Measure restore time against the recovery time objective and data loss against the recovery point objective.	IT operations	Measured results table
09	Document gaps between measured and required results and the actions to close them.	IT lead	Gap and action list
10	Record the validation with dates, scope, results and sign-off.	IT lead	Validation record
11	Schedule the next validation and define the change triggers.	IT lead	Schedule and triggers

Where this applies.

All checklists →

By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days

Tell us what must not fail.

Discuss a Requirement →