Ransomware Recovery Plan Checklist: Restore Tests

01 / THE DECISION

Executive Summary & the Buyer’s Dilemma

What should a buyer verify?

Evaluate a ransomware recovery plan by restoring a critical business service in an isolated test environment, using credentials and instructions that remain available when production identity fails. Measure elapsed recovery time, usable data loss and business acceptance, then verify communications, supplier dependencies and decision ownership.

The core problem

Recovery plans often describe systems in a sequence that depends on the very accounts, networks and people the attacker has disrupted. Backup status can be green while the team cannot obtain a key, contact the provider or make the application usable.

The B3 read

Recovery is a business workflow performed by people under pressure. The test is whether a second authorized person can restore a useful service from trusted instructions while normal identity and communication channels are unavailable.

Minimum defensible standard

Maintain a protected recovery copy, independently recoverable access and keys, offline instructions, named decision-makers and evidence of a business-approved restore. Set recovery time and acceptable data loss from business impact, then measure them in a realistic exercise.

02 / THE EVIDENCE

The Core Decision Framework

Recovery priorities and supplier dependencies

What the vendor may claim: We can restore every server within our target.
Evidence to demand: Select the business service first, then map identity, DNS, network, certificates, keys, applications, data, licenses and external services it needs. Have the business owner define the minimum useful function.
Red flag: A server boot counts as recovery even though users cannot authenticate or complete a transaction.

Isolated and immutable backup verification

What the vendor may claim: Our backups are immutable.
Evidence to demand: Inspect retention locks, privileged roles, delete permissions, key access and separation from production identity. Use an authorized disposable test copy to verify the protection settings; never test deletion against your only recovery copy.
Red flag: The same compromised administrator can delete the copies, shorten their protection or remove the key needed to decrypt them.

Independent restore and clean reconnection

What the vendor may claim: We test backups every month.
Evidence to demand: Witness a restore into an isolated environment using the documented recovery path. Record elapsed time, recovered data point, integrity checks and business sign-off. Require a security decision before reconnection.
Red flag: The test restores one easy file, uses undocumented credentials or excludes the identity and application dependencies.

People, communications and decision authority

What the vendor may claim: Our incident team knows what to do.
Evidence to demand: Give a backup responder the offline runbook and exercise alternate communications, supplier contacts, containment authority and employee threat reporting. Include HR, physical security and legal roles where relevant.
Red flag: The plan assumes corporate email works, the lead engineer is available and employees will handle threatening messages themselves.

Buyer questions answered

Are immutable backups enough to recover from ransomware?

No. Immutability can protect a copy from certain changes, but you still need usable credentials, keys, application dependencies, recovery capacity and a tested path back to a trusted service. Verify the configuration and perform a restore.

How is a restore test different from a ransomware tabletop?

A tabletop tests decisions, communication and responsibilities through discussion. A restore exercise tests whether the recovery process actually works. Use both and carry the technical results into the next decision exercise.

What should a ransomware recovery test measure?

Measure the total time to an agreed business function, the recovered data point, failed dependencies, manual work and the approvals needed for safe reconnection. State what the exercise excluded so a narrow test is not mistaken for full recovery readiness.

03 / THE WORKING CHECKLIST

Practical Evaluation Checklist

Use the questions in a review meeting. Check a box after the requirement has been reviewed, then capture the actual evidence and decision in the downloadable worksheet. Page checkmarks are temporary and are not submitted.

The B3 evidence scale

Record each material requirement as 0: claim only, 1: dated evidence reviewed, or 2: buyer-witnessed test passed. Record the owner, evidence location, test date and unresolved condition alongside the score. This is B3’s meeting tool, not an industry rating or certification.

A total must never hide a failed critical control. Choose approval blockers before testing; keep a blocked control open until it passes or an authorized buyer explicitly accepts the exception.

Phase 1: Pre-commitment / discovery

What business function must return first?Choose a critical service with its business owner. Define an acceptable degraded mode and map the dependencies that make even that limited function possible.
What do RTO and RPO mean here?RTO is the target elapsed time to restore the agreed service; RPO is the target limit on lost data measured in time. Record the clock’s start, acceptance endpoint and assumptions instead of accepting a vendor’s generic figures.
Who controls the recovery copy and its keys?List administrative roles, retention changes, backup credentials, encryption keys and emergency access. Check whether compromise of production identity would also compromise or block recovery.
What must suppliers provide during an outage?Confirm restore assistance, replacement capacity, license activation, escalation contacts and evidence delivery. Document dependencies that the organization cannot restore on its own.

Phase 2: Technical & operational proof

Can a second responder restore the service?Run a controlled exercise in isolation. Use a backup responder and the approved emergency access process; simulate unavailable production identity without disabling live safety-critical services.
Is the backup usable and sufficiently protected?Verify retention settings and access separation, then restore an agreed sample including configuration and application data. Compare integrity and completeness against a known baseline.
When can people actually work again?Measure access retrieval, environment preparation, data restore, application validation and business acceptance separately. Record total elapsed time and the age of the recovered data; document excluded steps.
Who approves clean reconnection?Have the incident lead define the evidence needed before returning the restored environment to service, including investigation of the entry path and credential or configuration changes. A restored machine is not automatically a trusted machine.

Phase 3: Incident, failure & exit scenarios

Can we communicate without corporate email or SSO?Test an approved independent contact route and keep a protected offline contact list. Confirm who can authenticate instructions and which sensitive information must stay out of informal channels.
What if an employee receives a personal threat?Use a clearly announced tabletop scenario. Route the report to named HR, security and legal contacts; preserve evidence, arrange appropriate support and define emergency escalation. Do not send simulated threats to staff without their knowledge.
What if the supplier is also unavailable?Exercise the alternate path for backup access, recovery capacity and essential documentation. Record which services cannot operate without a specific provider and the business-approved fallback.
Who closes the exercise gaps?Assign each missed objective an owner and retest date. Preserve incident evidence and follow applicable notification processes; do not delete material merely because a service has resumed.

04 / FROM REPORTING TO REQUIREMENTS

Daily Brief Intelligence Bridge

These links preserve the original edition and its reporting context. The control recommendations below are B3 analysis; the incidents do not establish that any particular vendor passes or fails this checklist.

Daily Brief · 2026-10-05

CISA gives agencies until Wednesday to fix an exploited NetScaler SAML flaw

The buyer-side read: An exposed remote-access component can sit on the path needed for recovery. Test whether the team can obtain access and restore service while that component is isolated.

Read the dated B3 coverage →

Daily Brief · 2026-10-05

Warlock ransomware is still getting in through unpatched SharePoint servers

The buyer-side read: B3’s SharePoint ransomware coverage connects the initial access path with trusted domain infrastructure. The recovery test should include credential and configuration decisions, not only a copy of application data.

Read the dated B3 coverage →

Daily Brief · 2026-09-16

Likely North Korean operation buries espionage tooling inside load-balancing infrastructure

The buyer-side read: Compromised load-balancing infrastructure challenges the assumption that an apparently healthy dependency is trustworthy. Record which components require integrity checks before restoring traffic through them.

Read the dated B3 coverage →

05 / WHAT TO DO NEXT

Immediate Action Plan

Next 7 days

Choose one critical business service. Verify that two authorized people can locate its protected recovery copy, recovery credentials and offline instructions.

Next 30 days

Restore that service in an isolated exercise with production identity treated as unavailable. Have the business owner test its minimum useful function and sign the measured results.

Next 90 days

Close and retest the largest gaps. Codify ownership, supplier dependencies, emergency communications and evidence requirements; repeat after material system or identity changes.

Primary sources and scope

References checked October 17, 2026. The tests and decision rules in this guide are B3 recommendations unless a source is explicitly identified.

CISA #StopRansomware Guide
Reference for protected backups, exercised response and recovery, alternate communications and restoration priorities. The detailed acceptance exercises here are B3 recommendations.
NIST SP 800-34 Rev. 1: Contingency Planning Guide
Federal contingency-planning reference for assessing requirements and priorities. Apply it to your operating context; do not present use of this checklist as compliance or certification.

How to Evaluate a Ransomware Recovery Plan

Executive Summary & the Buyer’s Dilemma

What should a buyer verify?

The core problem

The B3 read

Minimum defensible standard

The Core Decision Framework

Recovery priorities and supplier dependencies

Isolated and immutable backup verification

Independent restore and clean reconnection

People, communications and decision authority

Buyer questions answered

Practical Evaluation Checklist

The B3 evidence scale

Phase 1: Pre-commitment / discovery

Phase 2: Technical & operational proof

Phase 3: Incident, failure & exit scenarios

Daily Brief Intelligence Bridge

CISA gives agencies until Wednesday to fix an exploited NetScaler SAML flaw

Warlock ransomware is still getting in through unpatched SharePoint servers

Likely North Korean operation buries espionage tooling inside load-balancing infrastructure

Immediate Action Plan

Next 7 days

Next 30 days

Next 90 days

Primary sources and scope

Continue your vendor review

Questions to Ask an MSP Before You Sign or Renew

AI Vendor Security Checklist for Procurement Teams