Backup and Disaster Recovery Audit Sample Report
What you receive: scores by domain, risk-rated findings with evidence, business risks and a prioritized roadmap. Fictional company, illustrative data.
Written for the owner and the administrator
Every finding says what was found, why it matters and how to fix it.
A 90-day roadmap, not a list of 96 problems
Findings are grouped into business risks and ordered by impact and effort.
Five reports and an Excel workbook
Corvane Engineering Group is a fictional 85-person engineering firm with two offices, Hyper-V servers, Microsoft 365 and a cloud backup copy. Every name and number on this page is invented to show the report format.
Score by domain
| Domain | Overall rating | Checks passed |
|---|---|---|
| Inventory and coverage | Partial | 7 of 12 |
| Recovery objectives | Fail | 3 of 12 |
| Backup architecture | Partial | 8 of 12 |
| Immutability and isolation | Fail | 4 of 12 |
| Backup security | Partial | 6 of 12 |
| Restore testing and evidence | Fail | 2 of 12 |
| Disaster recovery and continuity plan | Partial | 5 of 12 |
| Compliance and insurance evidence | Partial | 6 of 12 |
Sample findings
| ID | Finding | Severity |
|---|---|---|
| IM-01 | No immutable copy; cloud backups deletable by IT admin account | High |
| RT-02 | No full server restore tested in 22 months | High |
| RO-06 | ERP restore measured at 19 hours against a 4-hour RTO | High |
| BS-01 | Backup console uses domain sign-in without MFA | High |
| IN-03 | SharePoint and Teams not included in Microsoft 365 backup | High |
| IN-08 | Three production VMs missing from backup jobs | High |
| DR-08 | DR plan stored only on the file server it covers | Medium |
| CE-06 | Insurance application states backups are immutable | High |
Findings rolled up into business risks
| Business risk | Findings | Rating |
|---|---|---|
| Ransomware could destroy every backup copy | IM-01, BS-01, BS-03 | High |
| Key systems cannot be restored within business tolerance | RO-06, RT-02 | High |
| Data in Microsoft 365 and new servers is unprotected | IN-03, IN-08 | High |
| Insurance and audit answers are not supported by evidence | CE-06, RT-10 | High |
Next steps and roadmap
| Period | Actions |
|---|---|
| First 30 days | Enable immutability on the cloud copy in a separate account; MFA and separate admin accounts on the backup console; add missing VMs and Microsoft 365 workloads; correct the insurance answer with the broker |
| Days 31–60 | Agree RPO and RTO per tier with leadership; add a local restore copy for tier 1 systems; set alerts on job deletion and retention changes |
| Days 61–90 | Run and document full restores of tier 1 systems and one restore from the immutable copy; update the DR plan and run a tabletop exercise |
Page 13 of 16: Sample report
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report (this page)
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Get this report for your own backups
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.