Recovery Validation Checklist

Purpose

Use this checklist before declaring a restored system, service, or business process recovered.

A system is not recovered simply because it powers on or users can log in. Technical operation, security, data, monitoring, backups, access, and business functionality should all be checked.

Recovery Information

System or service: ____________________

Incident: ____________________

Recovery owner: ____________________

Business owner: ____________________

Restore date: ____________________

Validation date: ____________________

Restore Source

• Restore source identified.
• Restore point considered trustworthy.
• Backup integrity checked where practical.
• Restore source predates known malicious activity where required.
• Recovery source documented.

Technical Validation

• System starts correctly.
• Required services are running.
• Application operates normally.
• Required dependencies are available.
• Database connections work.
• Network connectivity is correct.
• DNS functions correctly where applicable.
• Integrations work.
• Performance is acceptable.
• Errors or warnings reviewed.

Data Validation

• Required data is present.
• Data appears complete.
• Recent transactions reviewed.
• File integrity checked where practical.
• Database integrity checked where appropriate.
• Business owner confirms required information is available.
• Missing data is documented.

Access Validation

• Required users can access the system.
• Unnecessary users do not have access.
• Administrator access reviewed.
• MFA enabled where required.
• Compromised credentials have been changed.
• Suspicious sessions revoked.
• Vendor access reviewed.
• Temporary recovery accounts reviewed.

Security Validation

• Vulnerability or weakness that contributed to the incident has been addressed.
• Required patches applied.
• Secure configuration restored.
• Endpoint protection active.
• Firewall protection active.
• Unnecessary exposure removed.
• Malicious persistence checked where relevant.
• Security tools functioning.

Logging and Monitoring

• Authentication logging active.
• Administrative activity logging active where required.
• Security alerts active.
• Logs reach the expected monitoring system.
• Incident indicators monitored where appropriate.
• Enhanced monitoring enabled temporarily if needed.

Backup Validation

• Normal backup schedule resumed.
• Backup failures will generate alerts.
• New backup created after recovery where appropriate.
• Backup access reviewed.
• Next restore test scheduled.

Business Validation

• Business owner tests the restored process.
• Key transactions work.
• Customer-facing functionality works.
• Required reports work.
• Required integrations work.
• Temporary workaround records reconciled.
• Users informed that the system is available.
• Known limitations communicated.

Residual Risk

Are any known risks still open?

• Yes / No

If yes:

Risk: ____________________

Owner: ____________________

Temporary control: ____________________

Due date: ____________________

Leadership acceptance required: Yes / No

Approval for Normal Use

Technical owner approval: ____________________

Security / IT approval: ____________________

Business owner approval: ____________________

Return-to-service date/time: ____________________

Evidence location: ____________________

Practical Rule

Recovery is complete only when the technology works, the business works, the security controls work, and the remaining risks are understood.