Scorecard · Resilience
Score your disaster recovery and business continuity program across 7 dimensions — RTO/RPO, backups, failover, runbooks, testing, dependencies, and communications. Find the gaps before your next incident does.
Most DR plans look great on paper and collapse in practice. The gaps aren't the missing backup — they're the untested failover, the dependency nobody documented, and the comms tree that hasn't been updated since 2021. This scorecard surfaces the practical gaps that matter during a real incident.
Out of 28. 22+ is resilient — tested and survivable. 15-21 is passable but exposed in novel incidents. Below 15 is the category where ransomware, SaaS outages, and regional cloud events actually hurt.
Four patterns separate resilient organizations: tiered RTO/RPO with business sign-off (so IT isn't arguing priority mid-incident), immutable backups verified with restore tests (not just backup success), warm-or-active secondary (cold-restore from tape is an 8-day outage, not 8 hours), and regular tested comms. The fifth pattern, increasingly required, is SaaS data protection — M365, Google Workspace, Salesforce, and similar platforms need their own backup, because native recycle bins aren't a DR plan.
Usually yes for tier-1/2 apps — pay for storage + minimal compute until invoked. Tier-0 real-time apps are where cost can climb.
Tabletop quarterly for critical apps, full failover annually, component tests monthly. Untested runbooks rot fast.
Score 18/28. Priorities: enforce immutable backups, stand up warm DR in Azure, annual failover test.
Score 10/28 pre, 23/28 twelve months in. Biggest lifts: Rubrik immutable + air-gapped copy, runbook automation, quarterly tabletops with exec sign-off.