DSP Resilience Triage

Know what to verify next.

Answer for one organization and one consistent scope. Choose “I don't know” when you cannot confirm an answer.

Do not enter names, credentials or inventory details. Your selected answers are transmitted for this assessment. This application does not save triage answers or results. Account registration is optional.

1. Can you name the three processes whose outage would cripple the organisation fastest?Without knowing what matters first, every recovery plan prioritises whoever shouts loudest.

2. Has anyone estimated what one hour of downtime costs for the most critical process?Cost per hour is what turns continuity into an investment decision instead of an opinion.

3. Has the business defined when an interruption of each critical process would become unacceptable?Business tolerance sets the boundary against which recovery objectives and measured recovery times should be compared.

4. Do you know which systems, vendors and people each critical process depends on to function?Unmapped dependencies can prevent recovery even when individual systems have backups.

5. Does any critical service depend on a single vendor with no viable alternative?Recovery capability for that link sits outside your control.

6. Is there a written plan for how operations continue during a prolonged outage?Without a written plan, continuity depends on improvisation and on whoever happens to be available.

7. Has that plan been exercised, by simulation or tabletop, in the last twelve months?An unexercised plan is a hypothesis. The exercise is what reveals what is missing.

8. If the entire IT environment went down right now, where would the plan be and who could reach it?A plan that lives inside the environment dies with it.

9. Is there an up-to-date contact list with channels that do not depend on corporate email and telephony?Corporate communication channels may be unavailable during an interruption.

10. Does someone have explicit authority to declare a crisis and trigger the plan without asking permission?Without defined authority, the first hours are lost deciding who decides.

11. Do backups exist for the most critical system?Without a copy there is no recovery, only rebuilding.

12. Has a full restore of that system been executed and timed in the last six months?This is the method's central question. A backup never restored is an expectation, not a capability.

13. If a timed restore was done, was the measured time within what the business tolerates?Restoring in 20 hours a process that tolerates 4 is restoring too late.

14. Is there an immutable or disconnected backup copy, beyond the reach of an attack on the main environment?Modern ransomware encrypts the backup before production.

15. Are the credentials needed to restore kept outside the environment that would be restored?A key stored inside the safe it is meant to open does not open the safe.

16. Is there a written recovery procedure for the most critical system, executable by someone other than the usual expert?A procedure that depends on one person is a human single point of failure.

17. Do the tests performed leave archived evidence, with date, time and result?Without evidence, the test can be neither audited nor compared with the next one.

18. Is there a named owner who maintains and reviews the continuity programme periodically?A programme with no owner ages until it no longer describes the environment.