Recovery Readiness Assessment · Australia

Recovery Readiness Assessment: the recovery position documented, the gaps prioritised and a 90-day roadmap to close them

Most organisations have backups. Fewer have tested whether recovery would actually work under cyber-incident conditions. Inlight IT runs a scenario-based review of recovery capability — backup architecture, identity recovery sequencing and dependency modelling — when the position has to be evidenced for insurance, audit or the board.

  • Scope, timing and cost agreed before the work starts
  • Engineering-led, not interview-based
  • Scenario-based, not questionnaire-based
  • Findings documented whichever path follows
What recovery readiness covers
Backup architecture
Separation from production, immutability, versioning and retention
Identity recovery
Active Directory and Entra ID recovery sequence, tested first
Cyber Recovery Time
Modelled per critical service against a documented dependency map
Evidence and documentation
Dated artefacts indexed to the questions underwriters ask
Why it comes up

Organisations usually arrive here because a renewal, audit, incident or board question has made recovery evidence urgent.

Six situations drive most Recovery Readiness Assessments. Select one to see what is usually behind it.

Cyber insurance renewal has sharpened
Questions that used to accept yes-or-no answers now request architecture diagrams, backup administrator MFA proofs, dated restore test reports, and per-service RTO and RPO targets. The internal team can answer some of it, but not all of it with confidence.
A peer was hit, and leadership is asking
A publicly reported incident in the sector has surfaced the question at the next leadership meeting. Leadership needs an evidence-backed answer rather than a verbal assurance from IT, and the organisation cannot produce that evidence quickly without external structure.
An auditor or customer wants recovery evidence
A security questionnaire, due diligence pack or internal audit request has arrived with specific recovery questions. The available artefacts are a backup software report and a generic IT policy. That gap is the trigger.
Controls exist, but not verified end to end
Backups are running. MFA is enforced across most accounts. An immutable copy exists. But the pieces have not been tested as a recovery whole against a real cyber incident scenario. Individual controls work; the end-to-end recovery path has never been walked.
A prior audit gave a score, no evidence
The earlier engagement produced a rating or a compliance certificate. It did not produce a prioritised remediation roadmap, a dependency map or evidence structured for the insurer's questions. The report is on file and does not answer the questions now being asked.
RTO commitments exist, untested under pressure
Documented recovery time objectives sit in the IT policy or DR plan. The targets have never been validated against the real architecture, real dependency chain or real time-to-identity-recovery. An insurer asking for tested RTO evidence is not likely to accept the documented number.
Within Backup and Disaster Recovery

A structured way to clarify the recovery position when evidence is needed.

A Recovery Readiness Assessment is the structured form of Backup and Disaster Recovery work that organisations engage when the recovery position needs to be documented, not just discussed. It is the engagement Inlight IT runs when insurance, audit, board governance or post-incident review requires a defensible recovery position with dated evidence.

Once the assessment is complete, holding that position over time is a separate operating question. How that happens depends on the organisation.

A

Take the remediation roadmap and execute it internally, with existing IT capability or provider

B

Engage Inlight IT for the remediation work, scoped separately against the gaps the assessment surfaces

C

Bring recovery posture into an ongoing managed-resilience relationship so it stays aligned as architecture changes

D

Fold it into a broader cyber operating discipline through Managed Cyber Security, where recovery readiness sits inside the wider security operating layer

The assessment findings are produced the same way regardless of who carries the work that follows.
Evidence, not assumption

Backup existence is not recovery evidence. Underwriters, auditors and leadership can tell the difference.

Most organisations enter the assessment assuming the recovery posture is stronger than the evidence supports. The work converts each assumption into documented fact, and flags where the assumption was wrong.

Assumption-based todayEvidence-based after
Backup job reports assumed to prove recovery will succeed
Dated restore test reports, signed by the engineer who performed them
Active Directory and Entra ID recovery never sequenced or tested
Identity recovery sequence documented and tested, Active Directory and Entra ID first
MFA coverage reported by approximation
MFA coverage verified against a named backup administrator account list
RTO targets written in a document, not modelled
Per-service Cyber Recovery Time tied to a documented dependency map
Insurance questionnaire answered from memory
Evidence indexed to underwriter categories, in a single dated pack
Incident response plan on file, never walked through
Incident response runbook with named roles, tested in a tabletop exercise
What we look at

Recovery architecture reviewed against the categories underwriters and auditors look at.

Eight categories, each scored with the evidence behind the score. The grade reflects what the environment can actually show, not what the policy states.

EvidencedBackup architectureDesign, tiers and coverage across the workloads that matter
EvidencedSeparation from productionWhether backups survive a compromise of the production estate
PartialRestore testingDated, realistic restore tests versus successful job reports
PartialRTO and RPOTargets modelled against real dependencies, not written on paper
EvidencedPrivileged access controlsBackup administrator MFA, separation and account hygiene
AssumedImmutability and versioningWhether recovery points can be destroyed within the retention window
PartialOperational documentationRunbooks, dependency maps and recovery order, current and usable
AssumedOwnership and reviewWho owns recovery, and when it was last exercised
EvidencedPartial evidenceAssumed — needs testingIllustrative starting grades seen across Australian environments
Cyber Recovery Time

Recovery modelled as a sequence, identity first.

Cyber Recovery Time is modelled per critical service against a real cyber incident scenario, tied to a dependency map. The order matters: nothing recovers cleanly until identity does. The timeline below shows an illustrative sequence.

Paper RTO targets are replaced with a defensible modelled number per service, and the assumptions behind each estimate are stated.
What you come away with

Dated artefacts you can hand to an insurer, an auditor or the board.

A documented recovery position, built to be useful across the conversations the organisation needs to have. Select an artefact to see what it contains.

Dated · signed
Recovery architecture review
Recovery architecture reviewed against the eight categories underwriters and auditors commonly look at: backup architecture, separation from production, restore testing, RTO and RPO, privileged access controls, immutability and versioning, operational documentation, ownership and review. Each category scored with the evidence behind the score.
Per critical service
Cyber Recovery Time model
Modelled recovery time per critical business service under a cyber incident scenario, tied to a documented dependency map. Includes the identity recovery sequence, the restore-and-validate path, and the assumptions behind each estimate. Replaces paper RTO targets with defensible modelled numbers.
Indexed to questions
Evidence pack
A structured collection of dated artefacts: architecture diagrams, MFA coverage reports, restore test reports, retention policy exports, dependency map and runbook, indexed against the questions insurers, auditors and governance teams typically ask. Built so the conversation runs from records rather than recollection.
30 / 60 / 90 days
90-day remediation roadmap
A prioritised plan for closing the gaps the review surfaces, sequenced by risk, commercial impact and dependency, and scoped into 30, 60 and 90-day tranches. Written so the internal team, an existing provider or Inlight IT could execute it.

The outputs are produced whether or not Inlight IT does the remediation work, and are written so a third party could execute them. The value is in the recovery position itself.

How we work

Scoped and priced up front, then run in defined phases.

Scenario modelling and evidence collection run in parallel where possible to keep the engagement compact, typically three to four weeks from scope agreement to final outputs.

1
Scope and scenario definition

The assessment boundary is defined, critical business services confirmed, cyber incident scenarios to be modelled identified, and the initial dependency map produced. Scope is locked before evidence collection begins.

2
Evidence collection

Technical verification across the eight audit categories: backup architecture, separation from production, restore test history, RTO and RPO documentation, privileged access controls, immutability posture, operational documentation, ownership assignment. Engineering-led, not interview-based.

3
Recovery modelling

Cyber Recovery Time per critical service modelled against the identified scenarios. Includes the identity recovery sequence, the restore-and-validate path, and the documented assumptions behind each estimate.

4
Outputs and handover

The outputs are produced, findings presented in both technical and summary formats, and the 90-day roadmap handed over. The work is led by an engineer who understands the environment, presents the findings and is available for follow-up questions.

Track record

Delivered with engineering discipline, not a checklist run.

8
Recovery categories scored against what underwriters and auditors review
3–4 weeks
From scope agreement to final outputs, scenario modelling run in parallel
Identity-first
Active Directory and Entra ID recovery sequenced before applications
90day
Remediation roadmap in 30, 60 and 90-day tranches
Healthcare
Recovery readiness delivered with clinic continuity in scope
Why Inlight IT

Engineering-led, scenario-based, and useful whatever happens next.

The assessment is shaped by what insurers, auditors and leadership teams actually do with the output. That shapes how the work is done.

01

Engineering-led, not consultant-led

The work is done by engineers with hands-on experience across backup architecture, identity recovery, Microsoft 365, endpoint, network and incident response. Maturity claims are tested against operating reality, not against a checklist.

02

Scenario-based, not questionnaire-based

Recovery is modelled against actual cyber incident scenarios, not generalised DR conditions. Identity recovery sequencing, restore throughput under realistic load, dependency ordering and validation steps are part of the model.

03

One engineer, end to end

The same engineer scopes the work, runs the review, presents the findings and is available for follow-up questions. The person presenting the findings is the person who collected the evidence, and that continuity is part of why the work holds up under external review.

04

Findings stand on their own

The outputs are produced whether or not Inlight IT carries the remediation work, and are written so a third party could execute them. The assessment is not structured as a lead-in to follow-on work; the value is in the recovery position itself.

A backup that exists is not the same as a recovery path that works. The difference matters most on the day it is tested by an attacker.

Common questions

Practical questions about scope, pricing, delivery and what the assessment produces.

What is the Recovery Readiness Assessment?

Engineering-led work Inlight IT does alongside the organisation to clarify whether recovery would actually hold under cyber incident conditions. It is scenario-based and evidence-led, typically runs three to four weeks, and produces a documented recovery position, a Cyber Recovery Time model per critical service, evidence indexed for insurance and audit conversations, and a 90-day remediation roadmap.

What does the assessment cost?

The cost is agreed at the scoping call, based on user count, platform mix, number of sites and the critical services in scope. Scope, timing and cost are settled before the work starts, so the organisation knows what is being reviewed and what will be produced. Any material change is talked through before it proceeds.

How long does the assessment take?

Three to four weeks from scope agreement to final outputs. Timeframe depends on environment size, platform mix and the availability of existing documentation. Scenario modelling and evidence collection run in parallel where possible to keep the engagement compact.

How is this different from a generic backup audit?

A backup audit typically checks whether backups are running and producing reports. This work asks whether the organisation could actually recover from cyber attacks, a different question. Scenario modelling, identity recovery sequencing, dependency mapping, Cyber Recovery Time and the evidence pack for insurance and audit conversations are part of this work that a backup audit does not produce.

Does the assessment cover Microsoft 365 data?

Yes. Microsoft 365 backup, retention and malware replication risk are assessed as part of the scope. Where platform-native retention alone would not be sufficient under cyber incident conditions, that gap is documented and included in the remediation roadmap.

What happens after the assessment?

It depends on the organisation. Some teams execute the 90-day roadmap internally or through an existing provider. Some engage Inlight IT for the remediation work, scoped separately. Some bring recovery posture into an ongoing managed-resilience relationship, or into a broader cyber operating discipline through Managed Cyber Security. The outputs are usable whichever path follows.

Is this a penetration test?

No. This work looks at recovery capability, not offensive security posture. It does not attempt to breach the environment or test control bypass. It is a structured review of backup architecture, identity recovery sequencing, scenario modelling, dependency mapping and evidence maturity. For offensive security testing, a separate penetration testing engagement is the right kind of work.

Will it produce something we can give to our insurer?

Yes. The work produces an evidence pack indexed against the categories underwriters commonly review: backup architecture, privileged access controls, restore test evidence, RTO and RPO per critical service, dependency modelling and operational documentation. Each claim is mapped to a specific dated artefact, so the renewal conversation runs from records rather than recollection.

What if we have already had a backup audit?

This work is useful even where a prior review exists. A common pattern is that a previous audit scored the environment but did not produce actionable remediation or evidence structured for insurer use. The work can be scoped to build on prior reviews rather than duplicate them, if the earlier work is shared at the scoping call.

Practical next step

Clarify the recovery position before it has to be proven under pressure.

Discuss a Recovery Readiness Assessment