Poro Advisory

Cyber Awareness for the Boardroom · Guide 2

Backups working. Could the service recover?

A practical guide to dependencies, trusted information and recovery evidence.

Your board paper says the backups are working. That shows data is being protected. The next question is whether a critical business service can be restored safely, with its essential dependencies available and its information trusted. The second guide in our Cyber Awareness Month series — for banks, other organisations and private offices.

5-page PDF Prepared by Professor Buck Rogers
Front cover of the Poro Advisory guide: Backups working. Could the service recover?

What's inside

  • Services and dependencies

    Start with the business service, not the system — and map the whole recovery chain, including what sits outside your direct control.

  • Trust and recovery evidence

    A successful restore is not the same as information that is safe to use. How recovered records are validated, reconciled and approved.

  • Five board questions

    From which services matter most to when you last demonstrated complete service recovery — and what changed afterwards.

  • Ten minutes at the next meeting

    “Could payments resume safely?” — a structured ten-minute recovery discussion with a follow-up record.

The key insight

“Restoring one component does not necessarily restore the service. The least understood dependency may determine when operations can resume.”

Get your free copy

Tell us where to send it and we'll email you the download link straight away.

We'll only use your details to send the guide and occasional Poro Advisory insights. No sharing, ever.

From the guide

Beyond working backups: can the business service actually recover?

A database restoration test answers a useful technical question. It does not show that the people, systems and external connections needed to deliver a service will work together after a cyber incident. The full guide works through this in detail; here are the essentials.

The questions a board should ask

  • Which business services matter most — and what outcome must be restored, within what acceptable period of disruption?
  • What must be restored for those services to operate? Look for the full chain of technology, information, people, processes and third parties.
  • How long would recovery really take? Distinguish demonstrated recovery time from assumptions and individual system targets.
  • How do we know recovered information can be trusted, and who has authority to approve resumption?
  • When did we last demonstrate complete service recovery — and what failed and changed?

The evidence to request

  • A dependency map for one critical service — including identity and privileged access, external connections, third-party providers and any reliance on a single person or provider.
  • Integrity checks on restored information — a backup can restore successfully while holding incomplete, corrupted or already-compromised data.
  • A complete service recovery exercise — what was actually demonstrated versus assumed or left outside the test, and the time to resume safely.

One useful request for the next paper: "Show us the last complete service recovery exercise, the dependencies it tested, the time to resume safely and the gaps still open."

A practical scenario

A cyber incident disrupts customer payments. The backups restore successfully, but identity services remain unavailable and the external payment connection has not been re-established. Transactions around the disruption cannot yet be reconciled. Customers are waiting and a payment deadline is approaching.

A sound response: essential dependencies are available, restored records are validated and transactions reconciled, and the authorised decision maker has evidence that operations can resume safely. Where that isn't established, management follows agreed continuity arrangements and explains the uncertainty.

Buck's interpretation

Recovery is a business decision, not just a technical one. Technology, operations and risk leaders need to agree recovery priorities and the conditions for resuming service — a technically available system is only part of that decision, and restarting before records are trusted can create further harm for customers.

Exercises should challenge assumptions, including people or providers that may themselves be affected. Every weakness found needs an accountable owner, a review date and a check that the fix worked. A confident discussion does not demonstrate recovery capability.

The full guide includes the structured ten-minute recovery discussion for your next meeting and a follow-up record template.

Download the full guide