OCI DOMAIN ONE
We work with technology teams so the data is there when it matters.
Backups that have never been restored, a recovery plan that lives in one engineer's head, and an outage window the business never agreed to. We test the recovery path with your team, so a bad day stays a bad day and does not become a lost week.
What technology leaders say about working with us.
Scott is one of those rare professionals you encounter only a few times in your career.
Working with Scott and Jonathan is a refreshing experience and one I hold out as metric when dealing with vendor partners.
Chris ZitoInformation Technology Security Manager
Working with Jonathan and Rullan Scott Technologies has been an exceptional experience.
Bladimir GonzalezWestgate ResortsThe risk of not having data you can restore
A failed restore is rarely a technical problem. It is hours of downtime, data that cannot be recreated, and customers who do not wait.
The job reports success every night, yet nobody has simulated a full restore in years. Unverified assumptions like that only get tested when the incident forces the question, and that's when incomplete or corrupt backups turn up, with everything written since the last good copy gone for good.
Then there's the recovery sequence itself. If it lives in one engineer's head, your recovery time is that person's availability. Leave, illness, or a holiday on the day of an incident, and a one-day restore becomes a week of guesswork while a vendor learns your environment on the clock.
RTOs are often a number nobody has tested against the architecture. The business plans for one hour of downtime while the design needs two days. At £10,000 an hour, that gap costs £480,000 before the first system is back, plus missed SLAs and idle staff.
Where you are now, and where you can be
Where most organisations are today
- Backup logs are checked, but a restore has never been timed.
- One person knows the recovery order.
- The business expects hours; the design delivers days.
Where you can be
- Restores are tested on a schedule and the results are recorded.
- The recovery sequence is documented, owned and rehearsed by more than one person.
- Recovery time is a measured figure the business has agreed to.
Sample OCI result
Recoverability
Critical Drag
15/ 18
Every domain is scored 0 to 18. A higher score means lower operational confidence.
Get your Recoverability score
The Operational Confidence Index turns a vague worry into a number you can act on.
- See your Recoverability score out of 18, alongside the other three domains.
- Find out whether your recovery assumptions hold up against a live system, not a checklist.
- Get a report you can take to leadership to justify a restore test.
How we help you recover with confidence
Backup verification
Backup jobs report success every night. We restore real data from them on a defined schedule, so the evidence for your board is a completed test, not a green checkmark.
Recovery time reality
Most RTOs are promises nobody's measured. We time yours, actual restore against actual recovery, until the number the business plans around is the number the architecture can deliver. (RTO, the Recovery Time Objective, is how long you can afford to be down. RPO, the Recovery Point Objective, is how much data you can afford to lose, measured in time. Both get the same treatment.)
Single points of knowledge
If one engineer disappeared tomorrow, could anyone else run the recovery? We turn that sequence into a governed runbook so the answer is yes.
Ransomware recovery path
An attack doesn't have to cost you weeks of trading. We map, sequence, and rehearse the full recovery from encryption ahead of time, so when it happens it costs days instead.
Dependency mapping
Recovery order matters as much as recovery speed. We identify which systems come back first and what depends on them, so revenue-critical services aren't waiting behind low-priority ones.
Immutability and isolation
Could an attacker with stolen credentials delete your way back? We verify production access can't alter or remove your backups, closing that door before it's tested the hard way.
What we usually hear
“We have a disaster recovery plan.”
Almost everyone does. The real question the index asks is when that plan was last run against live systems, how long it took, and what broke along the way.
“Our MSP handles backups.”
Worth checking what they’re actually contracted to guarantee. Most backup contracts commit to running the job, not to the restorability of what it produces. Confirm that distinction in writing before you need it.
“We are on cloud, so recovery is covered.”
Cloud providers protect their infrastructure, not your data against your own mistakes. Most operate a shared responsibility model in which retention, versioning and recovery of your data remain yours.
“We tested last year.”
Then the question is what has changed since: new systems, new dependencies, staff turnover. A year-old test describes an environment that no longer exists.
Questions about this domain
How is recoverability scored in the OCI?
Recoverability is one of the four domains in the Operational Confidence Index. Six questions, each scored 0 to 3, give a domain range of 0 to 18. A higher score means lower operational confidence, so a high recoverability score indicates that this is the area to address first.
Do I need to know my RTO and RPO to answer the questions?
No, and that's often the point. RTO (Recovery Time Objective) is the longest your systems can be down before the business impact becomes unacceptable. RPO (Recovery Point Objective) is the most data you can afford to lose, measured in time: in other words, how far back your last usable backup can be. Most organisations haven't pinned either number down in writing. You don't need them before you start, and working them out is one of the things the diagnostic helps with.
Is this an audit?
No. It is a self-assessment that takes 5 minutes and returns a scored view of where your risk concentrates. An audit is a much longer piece of work and is not what this is.
What happens after I complete it?
You receive your score, a breakdown by domain, and a report. If you want to talk through the result, you can book thirty minutes with a cofounder. There is no follow-up unless you ask for one.
Does Rullan Scott sell backup software?
No. There is no manufacturer relationship and no commission behind any recommendation. The firm assesses environments and advises on them. It does not resell technology.
The other three domains
OCI Domain Two
Technology Strategy
Whether renewals, platforms and architecture choices still fit how the business works today.
Explore this domainOCI Domain Three
Network Operations
How the network is really kept running: alerts, change control and cover when people are away.
Explore this domainOCI Domain Four
SaaS & AI Governance
The applications and AI tools in use, who still has access, and what company data they can reach.
Explore this domainFind out how recoverability scores in your environment.
Twenty-four questions across four domains, 5 minutes, and an instant read on where your operational risk actually sits.
Run the OCI Diagnostic