Verification.
WHAT TO TEST
That backups restore That account recovery works without your usual device That updates are applying That access removal is complete That people know what to do
HOW TO TEST ACCESS REMOVAL
Take a person who left and check every system for their account.
You will usually find one.
HOW TO TEST RECOVERY
Attempt to recover a critical account without your phone.
Most people discover they cannot.
HOW TO TEST AWARENESS
Ask people what they would do with a suspicious payment request.
Their answer tells you whether training worked.
WHAT NOT TO DO
Test staff by deceiving them punitively.
That damages the reporting culture you need.
WHAT IS FAIR
Explaining scenarios and discussing responses.
HOW OFTEN
Annually for most of this.
WHAT TO RECORD
What worked, what did not, and what changed.
WHAT TO DO WITH FINDINGS
Fix them. That is the point of testing.
