OCI DOMAIN ONE
Recoverability and ransomware risk
Almost every organisation has backups. Far fewer can say when a restore was last proven end to end, how long it would take, or whether the backup itself would survive the event it exists to protect against. Recoverability is the domain where the gap between what is assumed and what is true tends to be widest.
Does any of this sound familiar?
Your backup jobs report success every morning. Nobody has confirmed what a successful job actually restores.
You have a disaster recovery plan. The last time it was exercised, it was a discussion in a meeting room rather than a restore.
You could estimate your recovery time objective. You could not evidence it.
If ransomware encrypted production tonight, the recovery path exists on paper and has never been walked.
The person who understands the restore process in detail is one person, and they are not always available.
What this domain examines
Backup verification
Whether restores are tested against real data, on a defined schedule, with the results recorded.
Recovery time reality
Whether your stated RTO and RPO are measured figures or estimates nobody has challenged.
Immutability and isolation
Whether backup copies can be altered or deleted by the same credentials that manage production.
Ransomware recovery path
Whether a full recovery from an encryption event has been mapped, sequenced, and rehearsed.
Dependency mapping
Whether you know which systems must come back first, and what each of them depends on.
Why this goes unnoticed
Backup software reports on whether a job completed, not on whether the data it wrote can be read back into a working system. Those are different questions, and only one of them is answered daily.
Testing a restore properly requires downtime, a target environment to restore into, and someone's full attention for a day. Every organisation intends to do it. Most postpone it, because nothing appears to be wrong, and the cost of finding out is immediate while the cost of not knowing is theoretical.
Ransomware changed the arithmetic. An attacker who reaches your backup infrastructure using the same credentials that manage production does not have to defeat your recovery plan. They only have to reach it first. Recoverability is now the domain where an untested assumption carries the highest consequence.
What technology leaders say about working with us.
Unedited references from senior technology leaders who have worked directly with Jonathan and Scott.
Scott is one of those rare sales professionals you encounter only a few times in your career.
Working with Scott and Jonathan is a refreshing experience and one I hold out as metric when dealing with vendor partners.
Working with Jonathan and Rullan Scott Technologies has been an exceptional experience.
How Recoverability is scored
Every domain in the Operational Confidence Index is scored 6 to 18. A higher score means lower operational confidence, so the highest scoring domain in your result is the one to start with.
What we usually hear
“We have a disaster recovery plan.”
Almost everyone does. The index does not ask whether a plan exists. It asks when it was last executed against live systems, how long it took, and what failed during the attempt.
“Our MSP handles backups.”
Then the question is what they are contracted to guarantee. Most backup contracts commit to running the job, not to the restorability of what it produces. That distinction is worth confirming in writing before you need it.
“We are on cloud, so recovery is covered.”
Cloud providers protect their infrastructure, not your data against your own mistakes. Most operate a shared responsibility model in which retention, versioning and recovery of your data remain yours.
“We tested last year.”
Then the useful question is what has changed since. New systems, new dependencies, and staff turnover all move the answer, and a test that is a year old describes an environment that no longer exists.
Questions about this domain
How is recoverability scored in the OCI?
Recoverability is one of the four domains in the Operational Confidence Index. Six questions, each scored 0 to 3, give a domain range of 6 to 18. A higher score means lower operational confidence, so a high recoverability score indicates that this is the area to address first.
Do I need to know my RTO and RPO to answer the questions?
No. If you cannot state them, that is itself a valid answer and it will be reflected in the score. The index is designed to surface what is unknown, not to test what is memorised.
Is this an audit?
No. It is a self assessment that takes five minutes and returns a scored view of where your risk concentrates. An audit is a much longer piece of work and is not what this is.
What happens after I complete it?
You receive your score, a breakdown by domain, and a report. If you want to talk through the result, you can book thirty minutes with a cofounder. There is no follow up unless you ask for one.
Does Rullan Scott sell backup software?
No. There is no manufacturer relationship and no commission behind any recommendation. The firm assesses environments and advises on them. It does not resell technology.
The other three domains
Find out how recoverability scores in your environment.
Twenty four questions across four domains, five minutes, and an instant read on where your operational risk actually sits.
Run the OCI Diagnostic