If your most important system went down this morning, how long until you were back?
Fifty-six checks across the seven areas that decide whether an outage is an inconvenience or a crisis. Check what is true and tested today, not what the plan says should happen. Your section scores update as you go.
Rather work on paper? Download the Blank PDF (PDF, 12 pages).
Why plans fail on the day
The plan was never tested
Most continuity plans are written once and filed. The first real test is the incident, which is when missing credentials, outdated contacts, and wrong assumptions appear.
The targets were never agreed
IT assumes the business can wait a day; the business assumes IT can recover in an hour. Until someone writes down how long each system can be down and how much data can be lost, nobody is planning for the same event.
Backups exist, restores do not
Having backups is not the same as being able to restore from them quickly. Ransomware in particular targets the backups first.
The weak link is a vendor
Cloud platforms, carriers, and software providers fail too. Your recovery depends on theirs, and on whether you know what they have promised.
What outages cost now
Outages are less frequent and far more expensive when they happen, and ransomware turned recovery into a security question. Our free 2025 State of Disruption report on business resilience goes deeper. Four facts set the stage.
of organizations say their most recent major outage cost more than $100,000, and one in five say more than $1 million.
Uptime Institute, Annual Outage Analysis 2026is the global average cost of a data breach, and recovery time is one of the biggest drivers of that cost.
IBM, Cost of a Data Breach 2026of organizations are not resilience-ready, and 63% sit in what Accenture calls the exposed zone.
Accenture, via AVANT State of Disruption 2025of breaches now involve a third party, so your recovery increasingly depends on someone else's.
Verizon, 2026 DBIRHow to use this assessment
Quick and practical. About ten minutes if the inventory exists, longer if it does not, which is itself a finding.
Think of one bad morning
Picture losing your most important system, or your main site, at 8 a.m. Answer for that morning.
Tested beats written
Check an item only if it has been done or proven, not just documented. Untested stays unchecked.
Bring operations and IT
Recovery targets are a business decision; recovery steps are a technical one. You need both in the room.
Use the result
Your weakest sections are what to close first, before the next audit, insurance renewal, or outage.
Section scores, weakest first
Where to start
Want a second read of your recovery plan?
We go through your results and your current plan with you, check your recovery targets against what your environment can actually do, and outline what closes each gap. If we name a supplier, we tell you in writing whether it pays us before you choose.
Sources
- AVANT Analytics, State of Disruption: Business Resilience (November 2025), provided by The Deady Group
- Uptime Institute, Annual Outage Analysis 2026
- IBM, Cost of a Data Breach 2026 (press release)
- Verizon, 2026 Data Breach Investigations Report
- NIST, SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems
- CISA, Cross-Sector Cybersecurity Performance Goals