Answer 24 quick questions about how you back up and protect your data. In about 5 minutes you'll get an instant recovery-readiness score and a clear picture of what would happen if ransomware or a failure hit tomorrow.
What's actually being backed up, and what's quietly being missed.
Critical data and systems are backed up automatically every day.
Backups cover everything that matters: servers, databases, and line-of-business apps, not just a few folders.
Cloud and SaaS data (Microsoft 365, Google Workspace) is independently backed up, not just left to the provider.
Laptops and desktops are backed up, not only the servers.
Whether your backups survive the same event that takes out production.
At least one backup copy is stored offsite or in the cloud, away from your main location.
You keep multiple backup copies across more than one type of storage (the 3-2-1 rule).
At least one backup is immutable or air-gapped so ransomware can't encrypt or delete it.
Backup systems use separate credentials from your main network, not the same admin login.
Backups that have never been restored are just hope, not insurance.
A full restore has been tested in the last 6 months to confirm the backups actually work.
Backups are monitored for success or failure and verified, not just assumed to be running.
The restore process is documented so recovery doesn't depend on one person's memory.
You know roughly how long a full recovery would actually take.
How much downtime and data loss the business can actually absorb.
You've defined how long the business can afford to be down (RTO) for your key systems.
You've defined how much data you could afford to lose (RPO), e.g. an hour versus a day.
Critical systems are prioritized so the most important ones come back online first.
Your backup frequency actually matches those recovery targets.
The written playbook for the day something actually goes wrong.
You have a written disaster-recovery / business-continuity plan.
The plan assigns clear roles, responsibilities, and who to call.
The DR plan has been rehearsed or tabletop-tested, not just written and filed away.
You have a way to keep operating (remote work, alternate site, failover) while systems are restored.
Whether one failure can take the whole business offline.
Critical infrastructure has redundancy, with no single server or device whose failure stops everything.
Servers and network gear are protected by UPS / backup power against outages.
Key systems can fail over to the cloud or a secondary site if the primary goes down.
Your IT provider or team has a defined response time (SLA) for disaster scenarios.