This worksheet turns a security plan into verifiable work. Start with the critical systems and recovery priorities. Use authorised checks and a safe test environment; an exercise should not interrupt live operations unnecessarily.
Review access evidence
For each essential service, record the owner and the authorised administrator list. Confirm whether important accounts use the approved authentication method and whether recovery contacts remain current. CISA’s MFA guidance provides a baseline reference.
Record exceptions with an owner and resolution date. Avoid putting passwords, recovery codes or other secrets in the worksheet. Refer to their approved storage location instead.
Check maintenance ownership
Identify who applies updates to devices, applications and supplier-managed services. Review evidence that the intended maintenance happened and note unsupported components. If a supplier performs the work, confirm the division of responsibilities rather than assuming every relevant service is covered.
Run a safe restoration test
- Choose an approved sample and a non-production recovery location.
- Record the recovery point and required backup source.
- Restore using the documented procedure.
- Check completeness, readability and any required application configuration.
- Record elapsed time, problems and the authorised cleanup process.
Compare the result with the business’s recovery requirement. A test of one file does not prove that the complete order system can be restored, so keep the tested scope explicit.
Walk through a response scenario
Use an illustrative scenario, such as an unexpected account sign-in followed by an unavailable application. Ask who receives the report, who contacts the provider and who coordinates operational decisions. Use simulated messages; do not send real phishing attachments or request secrets to make the exercise realistic.
Check that contacts are reachable through an independent route. Record where the response instructions are kept if the normal email or document service is unavailable.
Close actions with evidence
Maintain a short action register: finding, affected service, owner, due date and evidence of completion. Retest an important failed recovery step after correction. Review recurring findings separately from isolated mistakes so that ownership and process problems are addressed.
A completed worksheet describes the checks performed and their limits. It should not be presented as a guarantee against incidents or a certification of compliance.
