Backup and Disaster Recovery Audit
Find out whether your backups would survive ransomware and bring the business back in time. Read-only, vendor-neutral, $3,500 fixed.
Backups were targeted in 96% of ransomware attacks
Veeam’s 2024 survey of 1,200 organizations found attackers went after backup repositories almost every time. We check whether yours are out of reach.
A backup nobody has restored is a hope, not a plan
We compare your real restore times with the recovery targets your business needs.
What the backup and disaster recovery audit covers
The backup and disaster recovery audit answers one question for owners and IT leaders: if ransomware, a failed server or a cloud outage hit today, could you restore the systems that matter, from a copy an attacker could not touch, within the time the business can survive?
We review every backup product you run, on-premises and cloud, plus your Microsoft 365 data, your recovery targets, your DR plan and your restore evidence. The audit is read-only and vendor-neutral: we do not sell backup products.
One fixed price: $3,500, any organization size. On-site across Southern California, remote nationwide.
Eight domains, 96 checks
Each domain has its own page with what we check, why it matters and a sample finding.
Inventory and coverage
Every server, VM, database, endpoint, NAS, SaaS app and Microsoft 365 workload, and what is not protected.
Inventory and coverage →Recovery objectives
RPO and RTO per system tier, compared with what the business says it can tolerate.
Recovery objectives →Backup architecture
Copies, media, off-site location, retention and the 3-2-1-1-0 test.
Backup architecture →Immutability and isolation
Object lock, hardened repositories, retention lock, air gap and separate accounts.
Immutability and isolation →Backup security
Console MFA, separate admin accounts, domain separation, encryption, delete protection and alerts.
Backup security →Restore testing and evidence
Test records, restore times against your RTO and what an auditor or insurer will accept.
Restore testing and evidence →Disaster recovery and continuity plan
Written plan, runbooks, contacts, failover options and exercise history.
Disaster recovery and continuity plan →Compliance and insurance evidence
What HIPAA, PCI DSS, SOC 2, NIST CSF, IRS WISP and your insurer ask for, and whether you can prove it.
Compliance and insurance evidence →Which page answers your question?
Ransomware is our biggest worry
Start with immutability and backup security: these decide whether the attacker can reach your last good copy.
We have backups but never test restores
Restore testing turns a backup into evidence. We check what was tested and how long it really took.
We moved to Microsoft 365 and the cloud
Retention is not backup. See what Microsoft protects, what it does not, and what cloud backup should look like.
An auditor or insurer is asking about backups
See what HIPAA, PCI DSS, SOC 2, NIST CSF and insurers ask for, and the evidence that satisfies them.
Backups are the attacker’s first target
of ransomware attacks targeted backup repositories; attackers affected the backups in 76% of cases
Source: Veeam 2024 Ransomware Trends Reportof organizations hit by ransomware used backups to restore their data, the lowest rate in six years
Source: Sophos, State of Ransomware 2025to restore critical systems, proposed for HIPAA-regulated organizations (not final)
Source: HHS proposed rule, 90 FR 898, Jan 6, 2025of downtime a year is still allowed by a 99.9% availability target; 99.99% allows about 53 minutes
Source: Arithmetic: 8,760 hours a year × 0.1% and 0.01%A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Five deliverables
| Deliverable | What it contains | Who uses it |
|---|---|---|
| Executive summary | Recovery readiness score by domain, top business risks, decisions for leadership | Owner, CEO, board |
| Technical report | All 96 checks with Pass, Partial, Fail or Not applicable and the evidence | IT lead, IT provider |
| Risk register | Findings rolled up into business risks with likelihood, impact and owner | Leadership, compliance |
| Remediation roadmap | 30, 60 and 90-day plan ordered by impact and effort | IT lead, budget owner |
| Excel workbook | Every finding and inventory row for tracking | IT team, auditors |
A finding from the sample report
- Area
- Immutability and isolation
- Finding
- No backup copy is protected from deletion by an administrator
- Severity
- High
- Evidence
- Local backups sit on a domain-joined NAS, and the cloud copy can be deleted by the same IT admin account. No object lock or retention lock is enabled.
- Fix
- Enable immutability on the cloud copy in a separate account, separate backup administration from domain admins, and test a restore from the locked copy.
Every finding in the real report has this shape. See the full sample report
Page 1 of 16: Backup & Disaster Recovery Audit (hub)
- 1. Backup & Disaster Recovery Audit (hub) (this page)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Who books the backup and disaster recovery audit
Healthcare and dental practices
Contingency planning is a HIPAA Security Rule requirement, and the proposed update would add a 72-hour restore target.
CPA and tax firms
Tax-season downtime is expensive, and your WISP must cover backup and recovery.
Law firms
Client files and document systems must be recoverable and confidential.
Manufacturing and engineering
Production, quality and shipping systems decide how fast you are back in business.
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
What is a backup and disaster recovery audit?
An independent review of whether your backups cover the right systems, are protected from attackers, can be restored within your recovery targets, and are documented well enough for auditors and insurers. It covers 96 checks in 8 domains.
How much does it cost?
$3,500 fixed, any organization size. The price covers all backup products, cloud services and Microsoft 365 in scope.
Which backup products do you review?
Any. The audit is vendor-neutral: Veeam, Datto, Acronis, Rubrik, Cohesity, Commvault, Druva, Microsoft 365 Backup, Azure Backup, AWS Backup and others are all reviewed against the same checks.
Do you test-restore our data?
We do not run restores ourselves, because the audit is read-only. We review your restore records, and if your team runs a test during the audit window, we observe it and record the time and result as evidence.
Is this the same as the BCDR services page?
No. The BCDR services page covers planning and advisory work. This audit is the fixed-price, evidence-based review of the backups and recovery capability you have today.
Do you change anything in our backup system?
No. The audit is read-only. We review settings, job history and documents through a read-only role or a screen-share with your administrator. We never change, delete or run backup jobs.
Do you sell backup products?
No. OC Security Audit does not resell any backup product and earns no referral fees. If you want help installing or reconfiguring the product you choose, IT Perfection can do that work separately.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Know whether you could recover before you have to
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.Need the whole environment reviewed? The Internal Security Audit covers physical, logical and administrative controls for a fixed $3,500.