Recovery drill planning and results worksheet

01 Plan and authorise

• Write a scenario and success criteriaName the business task that must work, the required restore point, the expected recovery time and the person who will accept the result.
• Agree the exercise boundariesChoose a tabletop or isolated functional restore appropriate to the objective. A disruptive production test requires a separate approved change.
• Prepare an isolated recovery destinationCheck capacity, network separation, credentials and dependencies. Keep test integrations from sending real messages or changing live data.

02 Prepare the recovery path

• Confirm the recovery copy and restore pointRecord its timestamp and how it is protected from the original incident. Verify that the needed backup and recovery tooling are accessible.
• Make the runbook reachableConfirm authorised access to recovery instructions, keys and emergency credentials if the affected systems are unavailable. Record references, not secrets.
• Map dependencies and the recovery orderInclude identity, DNS, network, databases, applications and external services. Name who handles each dependency.

03 Run and verify

• Record the full timelineStart at the decision to recover. Capture access delays, restore start, restore completion and business validation, with timezones.
• Validate business use and data integrityHave a business owner open records and complete representative tasks. Check permissions and integrations inside the exercise boundary.
• Compare evidence with the objectivesRecord measured elapsed time and the actual restore point. Mark objectives met, missed or not tested; a partial test does not prove full recovery.

04 Close the loop

• Assign corrective actionsFor each gap, record the evidence, action, owner, due date and retest condition. Preserve failures as findings.
• Close the exercise environment safelyConfirm with the owner which temporary resources, test data and temporary access can be removed. Keep the agreed evidence.
• Set the next review and retestRetest corrections and revisit the plan after material system changes. Choose the exercise cadence to match business impact.

Decision and evidence

Use evidence references rather than passwords, tokens or personal records.