Conducting a Live-Recovery Test

Last updated: March 30, 2026

BCDR-4 Recovery Plan Testing is a required control for SOC 2, ISO27001 and other frameworks. This annual practices ensures your organization is prepared in the event of an incident or disaster that requires restoring a backup.

The steps below is an example best practice of how to conduct a live-recovery test and/or create a report as evidence.

Although not mandatory, it is ideal to record yourself conducting the recovery test steps to supplement the Recovery Test Report. Granting your auditor access to the recording allows them to attest that they witnessed the test, versus reading a detailed report of the procedure.

Several applications are referenced below (JIRA for tickets, GCP for Cloud), however they are strictly examples.

Mycroft VCISOs frequently help customers conduct their Annual Recovery Test in meetings! We can guide you through the steps below, or a similar table-top exercise, and handle generating a report as evidence for your auditor or records.

Objective: Validate that the organization can restore a critical production component from backup and capture sufficient evidence to demonstrate recovery capability to meet SOC 2 requirements.

Key Items:

  • Identify frequency of backups

  • Outline Recovery Workflow:

    • Responsible individuals

    • Align on ticketing and communication methods

      • How is the event logged

  • Verify time to restore/recover etc.

Test Type: Targeted backup restoration test (non-production / isolated)

Frequency: Annual (first execution)

Steps:

  1. Create JIRA ticket titled SOC 2 - Recovery Test (Backup Restore) and include the following info (can copy/paste to use as template):

    1. Test date: Feb 6, 2026

    2. System in scope: GCP

      • System tested: Cloud SQL primary database

      • Backup source: Daily

      • Recovery method: Restore backup to isolated test instance

    3. Start time: Feb 6, 2026, 14:00

    4. Completion time: Feb 6, 2026, 14:30

    5. RTO / RPO Results: 

      • Target RTO: 4 hours

        • Note: RTO (Recovery Time Objective): Acceptable time for restoring IT systems (i.e. speed of recovery)

      • Actual RTO: 30 minutes

      • RTO Met: Yes

      • Target RPO: 24 hours

        • Note: RPO (Recovery Point Objective): Maximum age of data that must be recovered (i.e. allowable data loss)

      • Actual RPO: 10 hours prior to incident (last backup)

      • RPO Met: Yes

    6. Environment: Non-production / isolated

    7. Successful restore: Yes / No

    8. Issues and lessons learned: Document any issues, or no issues observed

    9. Tester name: Name 1

    10. Reviewer name: Name 2

  1. Execute recovery test

    1. Identify and select recent backup 

    2. Take screenshot of backup date/time (attach to JIRA ticket)

  1. Restore the backup

    1. Restore to: new instance name (test db)

    2. Start a timer and document time in JIRA ticket

    3. Take screenshot of restore in progress / restore completion (attach to JIRA ticket)

  1. Validate the restore

    1. Instance is running, database reachable, data exists

    2. Take screenshot of successful connection / DB status running (attach to JIRA ticket)

  1. Stop timer

    1. Document end time in JIRA ticket

    2. Determine restore duration and document results