- Trace who can delete recovery copies or change their retention.
- Exercise recovery without relying on the identity system assumed compromised.
- Require technical and business validation before reconnecting restored services.
A restore test run by the usual domain administrator proves less than it appears to. During ransomware response, that account may be disabled, its sessions untrusted, and the backup console reachable only through the identity system being rebuilt.
Plan a recovery exercise around that constraint. Assume the normal administrative path is unavailable and ask the team to show how it would reach a protected copy, obtain keys, and restore a business service.
Trace the permissions that can destroy recovery
List who can delete backup copies, shorten retention, change storage policy, disable jobs, alter alerts, or recover encryption keys. Include service identities, vendor support accounts, and cloud organization administrators. Separate backup permissions from production administration where the platform supports it.
CISA's StopRansomware Guide recommends protected backups and recovery testing. Translate that into evidence for your chosen product: the retention configuration, the accounts that can change it, and a safe test of the applicable deletion restrictions. "Immutable" on a purchase order does not explain which administrative actions remain possible.
Keep copies and their administrative access from sharing a single failure path. Document what happens if a cloud account, identity tenant, or backup provider is unavailable. Verify how long retained copies remain usable and which keys they depend on.
Exercise an identity outage safely
Use an isolated recovery environment and an approved exercise plan. Do not disable production identity merely to make the test realistic.
Give the recovery engineer these conditions: ordinary SSO is unavailable, the primary administrator cannot participate, and production credentials must not be reused. Ask the engineer to locate the recovery instructions, obtain approved emergency access, retrieve the required keys, and identify the clean restore destination.
Record each dependency that stops progress. If instructions are in the unavailable document platform, move a controlled recovery copy somewhere the team can reach independently. If one person holds the only usable factor, establish a protected alternate path and test it.
Decide what makes a restore acceptable
Selecting the newest backup is not always appropriate when compromise may predate encryption. Have the response and recovery leads agree on the suspected compromise window, available evidence, and uncertainty around each candidate restore point.
Before reconnecting a restored service, check its configuration, administrative accounts, scheduled jobs, integrations, and monitoring. Rotate affected credentials through a coordinated plan that includes dependent services. Preserve incident evidence before destructive recovery actions when feasible; record urgent exceptions when containment cannot wait.
The application owner must also verify business correctness. Can the restored system process an order, reconcile a transaction, or retrieve the required record? A running virtual machine alone cannot answer that.
Give leadership a recovery decision
A hypothetical payroll briefing might say: "We restored the application in isolation. The finance owner has not completed reconciliation. Reconnecting now would meet the processing window but carries unresolved integrity risk. The next validation result is due at the agreed checkpoint."
That separates technical progress from permission to resume operations. Name who can accept a partial service, authorize downtime, and approve external statements. Ask legal and insurance contacts about their requirements without assuming a single notification deadline applies everywhere.
Finish with a recovery record: copy used, access path, elapsed time, missing dependencies, validation results, and the owner of every unresolved issue. Use the separate restore-test worksheet approach for routine backup testing between these exercises.
Turn this identity guidance into a review of MFA strength, privileged access, lifecycle controls, and audit visibility.