Where the risk shows up
Many ransomware scenarios fail recovery not because backups are missing, but because identities are compromised and recovery processes are unclear. If domain admins, backup admins and hypervisor access are not separated, recovery becomes unnecessarily risky.
A useful readiness check therefore treats identity, backup, network segmentation and recovery as one connected system.
Checks worth doing
- Separate privileged accounts and backup rights
- Verify offline or immutable backups
- Test realistic restore times
- Separate management access paths
- Prepare communication channels for the incident
What gets better
- Recovery becomes more realistic because identities, backup systems and management access are assessed together.
- Backup administrators are not automatically domain or hypervisor administrators.
- Restore tests show early whether processes, rights and communication paths work under pressure.
Where it can hurt
- Immutable backups help little when the identities needed for recovery are compromised.
- Overly optimistic RTO/RPO values create false confidence.
- Emergency processes often fail on dependencies such as DNS, AD, hypervisor, network or password vault.
Checks before rollout
- Who can delete backup jobs, encrypt backups or change retention?
- Does restore work without production AD?
- Are hypervisor, backup and domain admin roles separated?
- When was the last realistic restore test?