01 Backup schedules and restore-point visibility
Inspect backup schedules, status and available restore points with their versions and relevant scope. Identify failed or stale protection activity before an exercise or incident depends on an unusable recovery point.
02 Integrity and compatibility validation
Use backup manifests, checksums and version/schema compatibility checks to assess the restore artifact before it changes the recovery environment. Preserve the validation result and any corrective action in the recovery record.
03 Recovery readiness and runbooks
Define the declared recovery profile, prerequisites, responsibilities, sequence and verification steps. Readiness validation and auditable runbook execution help the team expose missing dependencies while the exercise is controlled.
04 Configuration and operational-state recovery
Recover the declared configuration and state, including the relevant policies, dashboards, reports, packs, connectors and NCM/IPAM metadata. Protected key or certificate references follow the secure backup and restoration policy.
05 Controlled endpoint redirection
Use authorized endpoint redirection to reconnect Sensors and Agents to the alternate Core endpoint as required by the recovery profile. Verify reconnection and correct control authority so the estate can resume its intended collection path.
06 Monitoring continuity and replay
Inspect ongoing authorized collection, local buffering, backlog and replay behavior during Core interruption or recovery. Explicit data-quality and delivery status help operators assess continuity as the current evidence becomes available again.
07 Core failover verification
Review the active/standby role, synchronization, failover reason, health and recovered control-plane behavior for the configured two-Core pair. Verify that only the intended node holds active authority, preserving the distinction between node continuity and site-loss recovery.
08 Service and dependency checks
Use the relevant path, DNS, TLS, API and other synthetic evidence to confirm usable behavior after the recovery step. Compare the recovered service with its network, storage, cloud and shared dependencies rather than treating a running process as the final result.
09 Observed recovery timing and gaps
Record the incident or exercise sequence, available recovery timestamps, validation results and remaining data or service gaps. Compare the observed outcome with the recovery objectives defined for your environment.
10 Exercise review and accountable follow-up
Preserve the runbook, artifact validation, role transition, reconnection, evidence completeness and service checks in the review record. Assign unresolved items through the relevant operational or ITSM workflow and repeat the targeted verification after correction.