The first real outage is the first time anyone learns the copy was thin, the runbook was wrong, or nobody had the credentials.
19 PUBLIC GUIDANCE
A job log is not a test
A backup or disaster-recovery design is not “tested” when the job is green. It is tested when you can prove, on a schedule, that the right work comes back into a usable system, by the people who would do it in a real incident, from a copy you would actually use.
01 WHAT WE ASSESS
A backup that has never been restored is a hypothesis. Testing is what turns it into evidence.
Most teams monitor backup jobs. That only proves a copy was written. It does not prove coverage, integrity, a working application, or that anyone can run the steps under pressure.
JFDI’s continuity work starts smaller than an annual “big bang.” Pick one item. Restore it. Write down what happened. For systems and workloads that is Veeam—including a restore or a scheduled test failover onto Microsoft Hyper-V or Microsoft Azure. For Microsoft 365 and Google Workspace that is Dropsuite—a mailbox, message, or Drive item.
The first real outage is the first time anyone learns the copy was thin, the runbook was wrong, or nobody had the credentials.
02 WORKING GUIDANCE
What you are actually proving
Every real test answers five questions. If it does not, it is a health check.
- 01
Coverage. Is the critical system, mailbox, Drive, or dataset actually in the backup?
- 02
Integrity. Is the copy complete and usable, not just present?
- 03
Recoverability. Does it come back as a working system or item, not only files on disk?
- 04
Time and loss. How long did the restore take, and how much work is missing? Recovery time objective (RTO) is how long the business can be down. Recovery point objective (RPO) is how much data loss is acceptable. Write those in business language; do not invent numbers on this page.
- 05
Operability. Can the people who would do this in an incident follow the steps, including who approves the restore, who has access, and who to call?
03 WORKING GUIDANCE
Do this before a live test
Skip this and the test is theatre.
- 01
Name what must return first, and who owns it.
- 02
List what it depends on: identity, domain-name settings (DNS), Microsoft 365 or Google Workspace, payments, certificates, and keys.
- 03
Write success before you start. Example: “Restore this mailbox and open the message from Tuesday” or “Boot this virtual machine (VM) in the test environment and log in as a user.”
- 04
Restore into a separate place—not over the live environment.
- 05
Name who may authorise the restore.
Public backup design often cites multiple copies, more than one media type, something offsite, and zero unverified restores. Treat that as a planning baseline, not a claim about JFDI’s default build.
04 WORKING GUIDANCE
A simple test ladder
| Level | What it is | What it proves | When |
|---|---|---|---|
| Job check | Backup finished, alerts if it did not | A copy was written | Every job |
| Item restore | One file, mailbox, Drive item, or table | Day-to-day recoverability | Regularly, for what hurts |
| Application or VM restore | App plus data, or a full virtual machine | It boots and a person can use it | On a schedule for what must return first |
| Test failover | Temporarily start a recovered copy on Microsoft Hyper-V or Microsoft Azure while live systems stay up | The recovery target works | When that target is in scope |
| Tabletop | Walk the scenario with people in the room | Decisions, contacts, missing steps | Periodically |
| Full cutover | Live systems down, recovery becomes live | Real time under load | Only with written approval—not this page’s offer |
NIST-style programs treat tabletop, functional, and full-scale exercises as different tools. A shop that only watches job logs has not used any of them.
05 WORKING GUIDANCE
How to test a backup: running the first test
- 01
Plan. Pick one scenario and one item. Examples: deleted mailbox; missing Drive file; corrupt SQL; one VM that must return. Declare what is out of scope. Name a technical operator and a business person who must say the restored thing is usable. Record the backup timestamp you will restore from.
- 02
Execute. Start the clock when you declare the test, not when a wizard finishes. Restore from the copy you would use if this were real. Bring dependencies up in order when the item needs them, such as identity and DNS before the application. Do not stop at “powered on” or “download complete.” Open it as a user.
- 03
Validate. Can the business owner use it? Does the last record match what you expected from the backup time? If this is a ransomware-style drill, keep the restore isolated and treat cleanliness as part of the test. JFDI’s public posture for ransomware on continuity pages is a clean restore path, not incident response.
- 04
Measure. Write the actual time to usable. Write how much work is missing. Write where the runbook broke: credentials, missing media, vendor delay, or an undocumented step.
- 05
Close. A failed test is a finding, not a humiliation. Assign an owner and a date. Fix the runbook the same week. Retest the failed path. Keep the notes. That record is the evidence.
06 WORKING GUIDANCE
What to test on this stack
Systems and workloads—Veeam. Restore one workload, or schedule a test failover onto Microsoft Hyper-V or Microsoft Azure. A test failover validates a test scenario. It is not a production disaster-recovery service. Workloads, restore authority, and the test target are confirmed in the assessment.
Microsoft 365 and Google Workspace—Dropsuite. Restore one mailbox, message, or Drive / Shared Drive item within the confirmed subscription coverage. Google Workspace coverage includes Gmail, My Drive, Shared Drives, Calendar, Contacts, and Groups; it does not include Tasks or Chat. Recycle Bin and Vault are not this test.
07 WORKING GUIDANCE
Record this after the test
Keep this on the page. It is not a download and not a second conversion.
| Field | Write |
|---|---|
| Date | |
| Scenario | |
| Item tested | |
| Engine (Veeam / Dropsuite / other) | |
| Where it was restored | |
| Who authorised it | |
| Backup timestamp used | |
| Time until it was usable | |
| What was missing | |
| What broke in the steps | |
| Owner of the fix | |
| Retest date | |
| Business owner sign-off | Usable / not usable |
08 WORKING GUIDANCE
How often
Public guidance is periodic testing, with more attention on the work that hurts most when it is missing. After a material change—such as a new host, identity change, backup upgrade, or real incident—test again.
This page does not publish JFDI’s internal calendar or promised recovery minutes.
09 WORKING GUIDANCE
Pass / fail
A test passes only if the scoped item is usable by the person who owns it, the restore used the intended copy, critical steps are written down, and the result is recorded.
A green backup job with no restore is not a pass.
04 THE OFFER
A continuity assessment that turns this page into a first restore test for your environment.
- 01
Choose one item.
- 02
Restore it without affecting live systems where possible.
- 03
Record the result.
05 THE AGREEMENT
This page is educational. A test failover is a test, not a production disaster-recovery service. JFDI is not an incident-response hotline.
One signed result: this item came back, here, in this amount of time, by these people.
This page uses public recovery-testing themes (including NIST and CISA guidance) and common practice for proving a restore. It is not JFDI's private runbook and it is not a certified plan.
07 QUESTIONS
Ask before you decide.
Is this JFDI’s runbook?+
No. It is an educational starting point.
Do we need Microsoft Azure?+
Only if it is the agreed recovery target for a Veeam test.
Can you run this during an active outage?+
JFDI is not an incident-response hotline. Contact your current IT provider or follow your incident-response plan. You can still book a business-hours planning call.
What happens on the assessment call?+
Identify what must return first, who can decide, what evidence is missing, and the smallest useful first test.
How often should we test?+
Set a regular test schedule, and give more attention to the work that hurts most when missing. Your business needs and environment determine how often and how thoroughly to test.
08 NEXT STEP