Recovery readiness
The Restart Copy Test
Every recovery plan rests on one assumption: that a clean copy exists when everything else is gone. Most plans never test the assumption. The Restart Copy Test does, in five questions.
What is a restart copy?
A restart copy is the copy you restart the business from after total compromise. Not the fastest copy. Not the biggest. The one nothing could touch.
The five questions
1. Is there a path to it?
Not "is it firewalled." Is there any network route from production to this copy? If a packet can reach it, so can the attacker who owns your network.
2. Does any of your credentials unlock it?
Ransomware crews spend weeks harvesting admin logins before they strike. If a stolen domain or cloud credential can touch the copy, the copy falls with the network.
3. Is its immutability physics or a setting?
A retention flag can be flipped by whoever holds root. Immutability enforced by hardware cannot. One is a policy. The other is a fact.
4. Can the person on shift restore from it?
Day one after an attack, your specialists are exhausted or locked out. If the restore needs a certified engineer and a vendor ticket, add weeks to every estimate.
5. Have you run the restore this quarter?
An untested copy is a hope. A rehearsed restore, verified clean, is a plan.
Five yes answers and you hold a restart copy. One no and you hold a hope.
Your network can still burn. The restart copy cannot.
Where it sits against 3-2-1-1-0
The industry teaches 3-2-1-1-0: three copies, two media, one offsite, one immutable, zero errors. The rule is right and almost nobody passes the last two digits honestly. The "1" is usually a cloud bucket with object lock, reachable by the same credentials the attacker stole. The "0" is usually unverified.
The Restart Copy Test is how you audit the "1" and the "0."
Continue the recovery audit
Recovering OT after total compromise · Why recovery copies fail · Physical isolation vs logical immutability · The 3-2-1-1-0 audit · Insurance-provable recovery
Restart copy vs cloud object lock · Restart copy vs tape · Restart copy vs rebuilding