Recovery Assurance Assessment
A structured review of your critical operations, recovery capabilities and available evidence. You get a clear view of where you stand and what to improve first.
What the assessment looks at
Why assess
The assessment shows how your existing controls align with recoverability, so you can invest where it matters.
Assessment scope
How monitoring, protection and response support recovery.
Coverage, separation, retention and how restores are checked.
Priorities, objectives, dependencies, runbooks and exercises.
Retention, retrieval, access and data residency.
How people, processes and providers continue during disruption.
Ownership, reporting and what has been validated.
How the assessment runs
Designed to fit around your team’s work. Scope is agreed with you at the start. It uses the Canadian Centre for Cyber Security’s baseline cyber security controls as a reference.
Conversations with key people and a review of documentation.
Mapping of critical services, systems, data and providers.
Comparison of current state with recovery expectations.
Findings with a risk level and a recommendation for each.
A prioritized path for improvement.
Questions the assessment helps explore
Do recovery objectives match what the business needs?
Do they reflect the environment as it is today?
Test results and records, not only policies.
Which providers are part of the recovery path?
Who decides, and how, during a disruption?
Which improvements reduce the most recovery risk?
What you receive
At the end of the assessment you receive an executive report describing the current situation and the gap to the desired state.
Each finding carries a level of risk and a recommendation, so the report can guide decisions and next steps.
Assessment scope and deliverables are agreed before work begins. Technical restore testing and coordinated recovery exercises are included where specified.
When to assess
Support readiness conversations with current evidence.
Cloud moves and new platforms change how recovery works.
New sites, systems and teams create new dependencies.
Answer recovery questions with evidence instead of assumptions.
Give incoming leaders a clear baseline.
Learn what worked and what needs attention.
Questions
It depends on scope and the number of critical services. Timing is agreed with you before work begins.
Usually an executive sponsor, IT or technology leads, and the owners of critical services. Key providers may be included where they are part of the recovery path.
An executive report with findings, a risk level and recommendation for each, and a prioritized roadmap.
The fee depends on the critical services, recovery environments and validation work included. We agree the scope, deliverables and fee with you before work begins.
It can support insurance conversations by organizing recovery evidence. It does not guarantee coverage, pricing or renewal. See Cyber Insurance Readiness.
Request an assessment
A 010 advisor will follow up to scope the assessment. No commitment.
