Verification.
WHAT TO TEST
That backups and exports restore That account recovery works That failover works, if you have it That access removal is complete That alerts actually arrive
THE ALERTS TEST
Trigger one deliberately and confirm it reaches a person.
Alerts configured to an unread address are common.
HOW TO TEST A RESTORE
Restore to a separate environment and confirm the data is complete and usable.
Not simply that the file downloads.
HOW TO TEST ACCESS REMOVAL
Take someone who left and check every service.
You will usually find one.
HOW TO TEST EXPOSURE
Check what is publicly accessible, across every storage location.
WHAT TO DO ABOUT FINDINGS
Fix them. That is the purpose.
HOW OFTEN
Annually for most of this, and after any significant change.
WHAT TO RECORD
What was tested, what worked, and what changed.
WHAT NOT TO ASSUME
That anything works because it is configured.
