Unverified Backup Restoration
Backups are taken but restoration has never been tested end to end.
- Remediation SLA
- 90 days
- Tier
- 3 · Best Practices
- Domain
- Data
- Escalation
- Reviewed at quarterly planning; may be formally deferred
What this finding is
Backup jobs run and report success, but no restoration has been performed to confirm the data is complete, usable, and recoverable within the stated objective. Includes the absence of immutable or logically-isolated copies, which determines whether backups survive a ransomware event at all.
Why it is Tier 3
An untested backup is an assumption. Restoration failures are common and are discovered at the worst possible moment — incomplete application state, missing encryption keys, or recovery times far exceeding the objective. Modern ransomware operators target backup infrastructure specifically, which makes immutability the difference between recovery and payment. Tier 3 reflects that this is preparatory rather than presently exploitable.
Most common misclassification
How to detect it
- 1Ask for the last successful restoration test; job success reports are not evidence of recoverability.
- 2Confirm at least one copy is immutable or logically isolated from production credentials, since backups reachable with production credentials are reachable by ransomware.
- 3Check whether encryption keys required for restoration are themselves backed up and independently recoverable.
- 4Measure actual restoration time against the stated recovery objective.
How to remediate it
Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.
- 1Perform a full restoration test of the most critical system into an isolated environment, and record the elapsed time.
- 2Implement immutable backup storage with a retention lock that operational credentials cannot override.
- 3Isolate backup infrastructure credentials from the production identity plane.
- 4Ensure key material needed for restoration is recoverable independently of the systems being restored.
- 5Schedule recurring restoration tests and treat a failed test as a finding rather than as a completed exercise.
How to verify the fix
A documented restoration test returns a critical system to a working state within the recovery objective, and at least one backup copy is confirmed immutable and inaccessible from production credentials.