A backup platform that reports green every night can still fail the one test that matters, restoring the business after ransomware, because job success says nothing about coverage, immutability, isolation or whether anyone has restored from it recently. This health check is a recurring, measured review of the backup platform as a whole: how much of the estate it protects, how many copies attackers cannot alter, whether recovery point and recovery time objectives are being met in practice, and whether the identities that run the platform are separated from the domain an attacker would compromise first. It is for infrastructure and backup owners, business continuity leads and the auditors and risk owners who need backup KPIs that stand up after a ransomware attack.
The Backup and Recovery Testing Checklist is the evidence form for a single restore test; this page is the quarterly audit of the platform that sits around those tests, and it uses their results as inputs. Design guidance for immutability, isolation and retention is in the Backup Security and Immutable Backup Guide; this page measures whether that design is still in place.
What this health check covers
The twelve metrics cover five areas:
- Protection: backup job success and the share of in-scope systems actually protected.
- Recoverability: restore test pass rate, recovery point objective (RPO) compliance and recovery time objective (RTO) proven by test.
- Ransomware resistance: immutable copy coverage, age of the latest isolated or air-gapped copy, and encryption coverage.
- Retention: drift between configured retention and the approved policy, including unauthorised shortening.
- Platform identity: backup administrator MFA and separation, and the service accounts the backup platform uses.
Who runs it: the backup platform owner collects the data, the business continuity or resilience lead reviews it, and the CISO or chief information officer signs it off. How to audit backups with it: run all twelve metrics each quarter, raise a finding for every amber or red result, and attach the most recent restore test records from the testing checklist as evidence for the recoverability metrics.
The metrics evidence NIST CSF 2.0 PR.DS-11 (backups of data are created, protected, maintained and tested) and RC.RP-03 (the integrity of backups is verified before restoration), and NIST SP 800-53 Rev. 5 CP-9 (system backup) with CP-9(1) testing for reliability and integrity and CP-9(8) cryptographic protection, CP-4 (contingency plan testing) and CP-10 (system recovery and reconstitution). They also line up with CIS Controls v8.1 Control 11, Data Recovery.
Key takeaways
- Success rate is the floor, not the goal. Pair job success with protected asset coverage, because systems never added to a policy never fail a job.
- Count the copies an attacker cannot touch. Immutable and isolated copy coverage for critical systems is the ransomware KPI that boards should see.
- A target is not a result. RTO counts only when a timed restore test has proven it within the last year; RPO counts only when the measured gap between successful backups meets it.
- Retention drifts quietly. Compare configured retention with the approved policy every quarter and alert on any reduction, since shortening retention is a known step before destroying backups.
- Backup admins are tier 0. Admin accounts and backup service accounts should be outside the production domain, behind phishing-resistant MFA and reviewed quarterly.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Backup Platform Health Check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Job failures and missed backups | Daily | Backup operations | Backup platform owner | Job report, failure tickets |
| Coverage reconciliation against inventory | Monthly | Backup platform owner | Infrastructure lead | Reconciliation worksheet, unprotected system list with reasons |
| Full health check (all metrics) | Quarterly | Backup platform owner | CISO or CIO | Metrics table, findings log, restore test records |
| Restore tests | Per the test plan; critical systems at least annually with a full timed restore | Recovery lead | Business continuity lead | Completed testing checklist per test |
| Backup admin and service account review | Quarterly | Identity team | Backup platform owner | Role assignment export, account list, MFA status |
| Independent assurance | Annually | Internal audit | Audit committee | Audit report, management responses |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. "Critical systems" are those in your top recovery tier in the business impact analysis, including identity systems such as directory services. RPO and RTO values come from your Backup and Recovery Policy Template tiers, not from this page.
| ID | Metric | Formula | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| BKP-01 | Backup job success rate | Backup jobs completed successfully on first run or retry inside the backup window / scheduled backup jobs in the period | Backup platform job history | ≥ 98% | 95% to below 98% | < 95% |
| BKP-02 | Protected asset coverage | In-scope systems, databases and SaaS tenants assigned to a backup policy with a successful backup in the last policy cycle / in-scope items in the asset inventory | Asset inventory or CMDB, cloud resource inventory, backup platform protected-object list | ≥ 98% | 93% to below 98% | < 93% |
| BKP-03 | Immutable copy coverage | Critical systems with at least one current copy on storage that cannot be changed or deleted before retention ends, even by backup administrators / critical systems | Backup platform copy and storage target configuration, storage lock settings | 100% | 90% to below 100% | < 90% |
| BKP-04 | Isolated copy age | Hours since the most recent successful copy of critical data reached the offline, air-gapped or logically isolated store (report the worst case across critical systems) | Isolated store copy logs, backup platform replication history | ≤ 24 | Above 24 to 72 | > 72 |
| BKP-05 | Restore test pass rate | Restore tests in the last 12 months that met the success criteria (data complete, application starts, integrity checks pass) / restore tests run in the last 12 months | Completed testing checklists, test tickets | ≥ 95% | 85% to below 95% | < 85% |
| BKP-06 | Critical systems restore tested | Critical systems with a passed restore test in the last 12 months / critical systems | Completed testing checklists, business impact analysis | 100% | 80% to below 100% | < 80% |
| BKP-07 | RPO compliance | Protected systems whose largest gap between successful backups in the period was within their RPO / protected systems | Backup platform job history, policy tier mapping | ≥ 98% | 93% to below 98% | < 93% |
| BKP-08 | RTO proven by test | Critical systems whose most recent timed restore completed within RTO / critical systems tested | Completed testing checklists with timings | 100% | 80% to below 100% | < 80% |
| BKP-09 | Encryption coverage | Backup copies encrypted at rest and in transit with keys held outside the backup storage / backup copies | Backup platform job and storage target configuration, key management records | 100% | 95% to below 100% | < 95% |
| BKP-10 | Retention policy drift | Backup policies whose configured retention, version count or lock period differs from the approved policy / backup policies | Backup platform policy export, approved retention schedule | 0% | Any longer than policy, each approved | Any shorter than policy |
| BKP-11 | Backup admin MFA and separation | Backup console admin accounts that are named, dedicated, not members of the production domain admin groups and use phishing-resistant MFA / backup console admin accounts | Backup console role export, directory group membership, IdP sign-in and MFA logs | 100% | 95% to below 100% | < 95% |
| BKP-12 | Backup service account hygiene | Service accounts used by the backup platform with documented owner, least privilege scope, no interactive logon and credentials rotated within policy / backup platform service accounts | Directory and cloud IAM account export, credential age report, backup platform credential store | 100% | 90% to below 100% | < 90% |
Alongside the table, report two counts without thresholds: the number of deletion, retention change or lock change events on the backup platform in the quarter, each matched to a change record, and the number of restore requests from the business. The first should be small and fully explained; the second shows whether people trust the platform enough to use it.
How to collect the data
- Reconcile coverage against an independent list (BKP-02). Export servers, virtual machines, databases, file shares and SaaS tenants from the asset inventory and each cloud provider's resource inventory. Join them to the backup platform's protected-object list. Every in-scope item that is not protected goes on the reconciliation worksheet with a reason. New cloud accounts and SaaS tenants are the usual gaps.
- Read job history, not schedules (BKP-01, BKP-07). Export job history for the quarter with start and end times, status and protected object. For RPO, compute the largest gap between successful backups per system and compare it with that system's tier. A job that succeeded but backed up zero changed data for weeks deserves a closer look.
- Inspect storage targets (BKP-03, BKP-04, BKP-09). Export the configuration of each storage target and copy job: lock or immutability mode and duration, whether the lock can be shortened by an administrator, encryption setting and where keys are held. For the isolated copy, read the copy logs at the isolated store itself, not only at the source.
- Use restore test records (BKP-05, BKP-06, BKP-08). Take results from completed Backup and Recovery Testing Checklist forms. A test without evidence counts as not tested. File-level restores do not prove RTO for a full system.
- Compare retention with policy (BKP-10). Export every backup policy's retention, versions and lock period and compare with the approved schedule. Pull the backup platform's audit log for any retention, deletion or lock change in the quarter and match each to a change record.
- Review identities (BKP-11, BKP-12). The identity team exports backup console role assignments, the directory groups those accounts belong to, MFA status from the identity provider, and the list of service accounts the platform uses with credential ages and logon rights.
Store the evidence outside the backup platform. If the platform were compromised, its own reports would be the first thing an attacker changes.
Red flags that need action now
- A critical system, or an identity system such as a domain controller, has no immutable or isolated copy.
- The isolated copy has not been refreshed for more than 72 hours and no one was alerted.
- Retention was shortened, or immutability locks were reduced or removed, without a change record.
- Backup console admin accounts are members of production domain admin groups, or sign in with a password alone.
- A backup service account has interactive logon rights or domain-wide administrative rights it does not need.
- No critical system has had a full timed restore test in the last 12 months.
- Bulk deletion of backup copies or restore points appears in the audit log.
- Encryption keys for backups are stored on the same platform or in the same domain as the backups.
CISA's #StopRansomware Guide warns that many ransomware variants look for accessible backups to delete or encrypt them, and NCSC advises that at least one backup should be offline at all times. Treat these red flags as possible signs of pre-ransomware activity, not as routine tasks.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-BKP-01 | [e.g. 22 cloud database instances not assigned to any backup policy] | BKP-02 | [High] | [Backup platform owner] | [date] | [Open] |
| HC-BKP-02 | [e.g. directory services have no immutable copy] | BKP-03 | [Critical] | [Infrastructure lead] | [date] | [Open] |
| HC-BKP-03 | [e.g. ERP full restore took 19 hours against an 8 hour RTO] | BKP-08 | [High] | [Recovery lead] | [date] | [Open] |
| HC-BKP-04 | [e.g. 2 backup admins are also domain admins] | BKP-11 | [Critical] | [Identity team] | [date] | [Open] |
Severity guide: Critical where an attacker with domain access could destroy every usable copy, High for coverage and recoverability gaps on critical systems, Medium for gaps on lower tiers, Low for record-keeping gaps.
Remediation map
| Finding type | Where the fix is described |
|---|---|
| Missing immutability, isolation or encryption | Backup Security and Immutable Backup Guide |
| No isolated recovery copy for critical data | Cyber Recovery Vault Guide |
| Backup admins and service accounts inside the production domain | Backup Identity Isolation Guide |
| Restore tests missing, failing or not timed | Restore Testing and Recovery Assurance Guide |
| Retention, RPO and RTO not defined per tier | Backup and Recovery Policy Template |
| Cloud workloads and SaaS tenants not protected | Cloud Native Backup and Ransomware Resilience Guide |
| Identity systems not recoverable | Identity Recovery Guide |
Related guides
- Backup and Recovery Testing Checklist: the per-test evidence form that feeds the recoverability metrics.
- Backup Security and Immutable Backup Guide: the design this check measures.
- Cyber Resilience Maturity Model: where backup and recovery sit in wider resilience maturity.
- IT Operations Security Metrics: reporting backup KPIs with other operations metrics.
- Backup Identity Isolation Guide: separating the identities that can destroy backups.
References
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- NIST: SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems
- CISA: #StopRansomware Guide
- NCSC: Offline backups in an online world
- CIS: Control 11, Data Recovery
Related NHI Mgmt Group resources: Backup and Recovery Testing Checklist, Backup Identity Isolation Guide, Cyber Recovery Vault Guide and Backup and Recovery Policy Template.