01 · Estate and coverage
Build a reconciled view of what needs protection and where the recovery copies actually live.
The multi-cloud recovery readiness playbook
30 questions to test your recovery readiness.
Bring evidence to your next resilience review.
A practical question bank for CISOs, backup and DR leaders, cloud architects, and partners serving AWS, Azure, and Google Cloud estates.
- 30Review questions
- 6Recovery domains
- 1Workshop worksheet
- 3Partner engagements
Why these questions matter
A backup report starts the conversation.
Recovery evidence moves it forward. Use the guide to identify what is known, what remains untested, and which gap deserves an owner next.
| Starting signal | Evidence to request |
|---|---|
| The backup job completed. | The restore result, validation scope, and measured recovery time. |
| We have several copies. | Where they reside, and which identities, keys, or services they share. |
| The copy is immutable. | The lock mode, retention state, and permissions that could affect it. |
| The finding was closed. | The before-and-after state, and the check that verified closure. |
| Storage looks orphaned. | Its lineage, owner, dependencies, and retention obligations. |
Six recovery domains
Ask only where a decision is open.
Each domain has five questions. Start with one opening question per domain, then expand where the answer is uncertain.
02 · Exposure and policy drift
Prioritize findings by the service at risk and the recovery options that remain.
03 · Action and verified closure
Make the boundary between automatic action and human approval explicit.
04 · Restore and service recovery
Match the strength of the evidence to the recovery claim you need to make.
05 · Copy lineage and storage purpose
Identify unnecessary spend without removing a required recovery option.
06 · Incident and executive evidence
Give decision-makers a bounded answer with the evidence and uncertainty attached.
Using the question bank
Start with one service. Leave with one plan.
Run a 45-minute discussion with the service owner, backup or DR lead, cloud architect, and security representative.
-
01
Define the scenario
Name the service and recovery objective. Choose deletion, compromised admin access, a regional outage, or a failed restore.
-
02
Ask six opening questions
Start with questions 1, 6, 11, 16, 21, and 26. Expand only where the answers expose a decision or uncertainty.
-
03
Record the evidence status
Use E for evidenced, G for a confirmed gap, U for unknown, or N/A with a documented reason. A missing observation is not proof that a backup is absent.
-
04
Assign the next step
Name an owner, a due date, and a verification criterion. Take the three most consequential items into the worksheet.
For cloud and backup services partners
Make the review a repeatable service.
Use the same evidence questions across AWS, Azure, and Google Cloud engagements, adapted to supported services and the client’s requirements.
Discovery
Open with questions 1, 6, 16, 21, and 26. Identify the service owner and request a small evidence sample before proposing changes.
Remediation
Use questions 11–15 to establish approvals and closure criteria. Work with the client’s existing cloud and backup providers on the appropriate remedy.
Recurring review
Revisit material changes, untested copies, and overdue actions. Use questions 28–30 to translate the results into a sponsor-ready review.
This guide supports discussion and prioritization. It is not a certification, audit opinion, or recovery guarantee, and it does not imply a formal partner authorization. Confirm supported integrations and validation scope with Forttic. The framework is described on the CRE framework page.