A backup is not a restored business

A successful backup job is an input to recovery. It is not proof that the organization can resume a complete service. We recommend defining recovery in the language of the business: an order fulfilled, a benefit payment reconciled or a customer able to obtain help.

01 / UNDERSTAND

The business issue

Recovery can fail because identity, network access, encryption keys, supplier connectivity or experienced staff are unavailable. The CISA ransomware guide recommends protected backups and testing. The executive question is whether those tests reproduce the dependencies of a real interruption.

02 / ACT

Your action guide

Explore each step, then use the questions with your business and technology teams.

DECISION INTO ACTION

Define the minimum service

Agree the smallest safe service that operations can sustain. Specify the data freshness required, the allowed manual actions and who decides when to resume.

Define the minimum service

Agree the smallest safe service that operations can sustain. Specify the data freshness required, the allowed manual actions and who decides when to resume.

Rehearse a clean restoration

Use an isolated exercise environment. Validate restore integrity, identity recovery and dependency sequencing without disrupting production or reconnecting potentially compromised systems.

Reconcile before scaling

Check transactions that occurred before, during and after interruption. Identify duplicates, missing work and customer communications before declaring normal operations.

Review the evidence. Revisit the decision.

Ask the leadership team
When did operations last accept a restored service using business evidence?

03 / VERIFY

What to measure

Establish your baseline and agree targets for the service. These are suggested measures, not claimed results.

Verified restoration time

Elapsed time to a tested business transaction, not just server availability.

Reconciliation backlog

Transactions still requiring validation after recovery.

Recovery exceptions

Untested dependencies and overdue corrective actions.

Use this in your next risk review

Working prompts for your team. Selections stay in this page only and are not a security assessment.

A business owner is accountable for this risk.The action has an owner and an agreed review date.The evidence demonstrates operation, not just policy.The remaining exposure is understood and accepted by the right authority.

04 / BUILD WITH US

How Genellipse helps

GeneSecure

GeneSecure can help consolidate incident information, affected assets and response actions so the recovery team works from a shared operational picture.

Explore GeneSecure

GeneComply

GeneComply can retain recovery-test evidence, control ownership and remediation records. Genellipse supports dependency mapping and exercise design; recovery commitments are established and tested for your environment.

Explore GeneComply

Choose the next exercise by customer consequence. The right result is a defensible restart decision, not a green backup dashboard.

Explore CISO Advisory

Office of CISO, GENELLIPSE

Sources & editorial notes

Original Genellipse analysis and practical recommendations. Primary guidance informs the technical context; linked organizations do not endorse Genellipse or its products.

CISA: StopRansomware Guide

Prepared for this archive on October 10, 2026. Examples are illustrative. Product scope, integrations and responsibilities are confirmed for each engagement.