Short answer
Only through evidence that the whole service has been restored under realistic conditions, not that backups exist. A board should ask for the results of end-to-end recovery tests on its most important services, measured against agreed impact tolerances, including what failed and what was fixed.
Evidence to request
- Dated results of recovery tests for each important business service, showing time to restore against tolerance.
- Confirmation that backups are isolated from the main network and were tested against a destructive attack scenario such as ransomware.
- The order in which systems would be restored, and who decides it during an incident.
- How customers would be served, and kept informed, while systems are unavailable.
- Findings from the last exercise and evidence the actions were closed.
Why 'backups are working' is not enough
- A successful backup job says nothing about how long a full restore takes.
- Services depend on many systems, suppliers and people; restoring one system rarely restores the service.
- Attackers increasingly target backups first, so untested assumptions fail at the worst moment.
Professor Buck Rogers' view
Recovery is where confidence and reality most often part company. If a bank has never rehearsed restoring a whole service, its recovery time is a hope, not a number.
Former CISO at the Bank of England and creator of the CBEST framework.