Backup & Operational Continuity Assessment
A guided assessment of your organization's backup coverage, recovery readiness, and continuity governance across nine operational areas. No system access required.
Free to use · no account required
Continuity Assessment
Work through each section at your own pace. All questions include operational context and specific next steps. Results are shown immediately — no email required.
Continuity Assessment
Backup & Operational Continuity Assessment
A guided review of your organization's backup coverage, recovery readiness, and continuity governance across nine operational areas. Work through each section at your own pace — results are shown immediately.
How It Works
What this tool does with your input
How this tool works, and what happens to what you enter
- You
You answer scoped questions
Short, concrete questions about how your environment is actually configured — not a quiz.
- The tool
Scoring runs in your browser
Your answers are evaluated locally against a published baseline — no tenant access, no agent, no connection to your systems.
- You
You get a prioritised gap list
Where you stand by area, with the sequence to address it.
What To Look For
Six Indicators of Continuity Readiness
Backup coverage alone does not indicate recovery capability. These are the most common gaps found in operational continuity assessments.
Dimension
What is assessed
Untested Restore Procedures
Backup job completion confirms data was written — it does not confirm the data is restorable. Only performing an actual restore validates recovery capability. Test at minimum annually and document the results.
Missing Microsoft 365 Backup
Microsoft's native recycle bins and retention features are not backup. Third-party backup covering Exchange, SharePoint, OneDrive, and Teams is required for genuine point-in-time recovery capability.
Single-Location Storage
Backup data stored only at the primary site is vulnerable to the same events that affect production. The 3-2-1 rule requires at least one copy offsite or in cloud storage geographically separate from primary infrastructure.
No Immutability Protection
Backup repositories accessible with standard administrative credentials can be encrypted or deleted by ransomware. Write-once or object-lock storage prevents modification during the retention window.
Undefined RTOs and RPOs
Recovery objectives that exist only as informal assumptions create conflicts during incidents. Documented RTOs and RPOs allow backup systems to be properly sized and prioritized before a recovery situation arises.
No Monitoring or Alerting
Backup jobs that fail silently can leave coverage gaps for days or weeks. Automated alerts on failure and missed schedules, combined with regular health reviews, catch gaps before they matter.
Untested Restore Procedures
Backup job completion confirms data was written — it does not confirm the data is restorable. Only performing an actual restore validates recovery capability. Test at minimum annually and document the results.
Missing Microsoft 365 Backup
Microsoft's native recycle bins and retention features are not backup. Third-party backup covering Exchange, SharePoint, OneDrive, and Teams is required for genuine point-in-time recovery capability.
Single-Location Storage
Backup data stored only at the primary site is vulnerable to the same events that affect production. The 3-2-1 rule requires at least one copy offsite or in cloud storage geographically separate from primary infrastructure.
No Immutability Protection
Backup repositories accessible with standard administrative credentials can be encrypted or deleted by ransomware. Write-once or object-lock storage prevents modification during the retention window.
Undefined RTOs and RPOs
Recovery objectives that exist only as informal assumptions create conflicts during incidents. Documented RTOs and RPOs allow backup systems to be properly sized and prioritized before a recovery situation arises.
No Monitoring or Alerting
Backup jobs that fail silently can leave coverage gaps for days or weeks. Automated alerts on failure and missed schedules, combined with regular health reviews, catch gaps before they matter.
What This Assessment Covers
Nine Areas of Operational Continuity Governance
Each section addresses a distinct dimension of backup and recovery readiness — from technical coverage to governance documentation.
Backup Coverage
Whether all critical systems are in scope, recovery point objectives are defined, and job completions are actively verified.
Microsoft 365 Backup
Whether Exchange, SharePoint, OneDrive, and Teams are covered by an independent third-party backup — not relying on Microsoft's native retention.
Restore Testing
Whether recovery procedures are validated through actual restore exercises, results are documented, and testing cadence meets compliance requirements.
Offsite Replication
Whether backup data is replicated to an independently managed offsite or cloud location with meaningful geographic separation.
Immutable Protection
Whether backup copies are protected against ransomware modification, and whether backup credentials are isolated from general administrative access.
Retention Policies
Whether retention periods are formally documented, configured in the backup system, and aligned with regulatory requirements.
Recovery Documentation
Whether RTOs are defined, step-by-step recovery runbooks exist, and documentation is kept current following infrastructure changes.
Monitoring & Alerting
Whether backup failures trigger immediate alerts, status is reviewed on a defined cadence, and storage capacity is monitored.
Disaster Recovery Readiness
Whether a DR plan is documented, has been tested or exercised, and escalation contacts are accessible independent of primary systems.
Why Continuity Governance Matters
Backup Is Infrastructure — Not an Insurance Policy
Organizations that treat backup as a passive safeguard discover its limitations during incidents. Continuity readiness requires governance, not just tooling.
Ransomware Has Changed the Stakes
Modern ransomware operators specifically target backup systems to eliminate recovery options before encrypting production data. Immutable offsite backup is no longer a best practice — it is the minimum viable protection posture for any organization holding sensitive or operationally critical data.
Microsoft Shared Responsibility Is Not Optional
Microsoft's service agreement explicitly states that customers are responsible for protecting their own data. The 30-day deleted items retention in Exchange and SharePoint is not a backup. Organizations in regulated industries that rely on Microsoft's native features for recovery face a significant compliance and operational exposure.
Compliance Requires Evidence, Not Intent
HIPAA, SOC 2, NIST 800-171, and ISO 27001 all require documented and tested backup and recovery procedures — not just the existence of backup software. Auditors routinely request restore test documentation, retention policy configuration evidence, and recovery time objectives during assessments.
Untested Backups Are Assumptions
An untested backup provides a false sense of security. Corrupt backup data, changed recovery environment configurations, missing credentials, and dependency gaps are common causes of failed recoveries. Only actual restore exercises, documented and repeated, provide operational confidence in recovery capability.
FAQ
Common Questions
Does this tool access my backup systems or production data?
No. This is a structured self-assessment questionnaire — it does not connect to your backup platform, production systems, or any infrastructure. You review each question against your environment and select the response that best reflects your current state.
What is the difference between backup and retention?
Retention policies — such as Microsoft 365 retention or a system's recycle bin — preserve data for a defined period before permanent deletion. Backup creates independent, recoverable copies of data at a point in time. Retention is a compliance control; backup is a recovery capability. They serve different purposes and one does not substitute for the other.
Why is Microsoft 365 backup included in a continuity assessment?
Microsoft operates under a shared responsibility model — they guarantee platform availability, but customer data protection is explicitly the customer's responsibility. Microsoft 365's native retention features do not constitute backup. Without a third-party backup solution, Exchange Online, SharePoint, OneDrive, and Teams data has no independent recovery capability.
What is RPO and RTO and why do they matter?
RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time — for example, "we can tolerate losing up to 4 hours of data." RTO (Recovery Time Objective) defines the maximum acceptable downtime — how long a system can be unavailable before it causes unacceptable business impact. Both must be defined to properly size backup frequency and recovery infrastructure.
What is immutable backup and why is it relevant?
Immutable backup storage prevents backup data from being modified, deleted, or encrypted during its retention period. Modern ransomware specifically targets backup systems to eliminate recovery options. Immutability — via write-once storage or object-lock policies in cloud storage — ensures backup data remains recoverable even if administrative credentials are compromised.
How often should backup and recovery procedures be reviewed?
Restore procedures should be tested at least annually — quarterly for critical systems. Documentation should be reviewed after any significant infrastructure change. Most compliance frameworks, including HIPAA and SOC 2, require evidence of tested backup and recovery procedures, not just the existence of a backup system.
Related Operational Guidance
A practice that assumed Microsoft 365 was covered under an existing backup agreement — and what the gap assessment actually found.
Guided assessment of M365 identity, email security, backup, and retention governance.
Full DNS diagnostic including MX routing and email authentication records.
Third-party Microsoft 365 backup and on-premises backup implementation and management.
Ongoing Microsoft 365 governance including backup configuration and retention policy alignment.
Align backup and continuity posture with HIPAA, SOC 2, and NIST requirements.
The 3-2-1 backup rule, its modern extension toward immutability, and how to design a strategy around actual recovery requirements.
Operational Support
Need help implementing backup and continuity controls?
IT KORR can assess your current backup posture, deploy Microsoft 365 backup, configure immutable offsite replication, and document recovery procedures aligned to your compliance requirements.
No commitment required — we respond within one business day.