Appearance
Disaster Recovery Test Results Log
Requirement: HIPAA §164.308(a)(7)(ii)(D) — Contingency plan testing and revision. Evidence that DR plans are periodically tested and findings are used to improve the plan.
Owner: Rory (Security Officer)
Update frequency: Within 5 business days of each DR test
Auditor use: This log is the primary evidence artifact for DR test frequency and RTO/RPO validation. Pair with the test plan documents for full context.
Test Schedule
| Test | Frequency | Participants | Test Plan |
|---|---|---|---|
| Full DR failover simulation | Quarterly (Q2 and Q4) | Rory, Kevin, Greg, Adriana | Per-quarter test plan doc |
| Veeam replica boot validation | Quarterly | Rory, Kevin | Included in DR test plan |
| SecOps platform recovery | Quarterly | Rory | Included in DR test plan |
| Twingate DR path validation | Quarterly | Rory | Included in DR test plan |
For the full test procedure see DR Failover Procedure.
For individual test plans see compliance/q2-dr-test-plan-2026.md and compliance/q4-dr-test-plan-2026.md.
How to Update This Log
After each DR test:
- Add a new section under the appropriate quarter
- Record: test date, participants, scenarios tested, RTO/RPO achieved, gaps found
- For each gap found, add an entry to the Open Gaps Tracker below
- Commit and push — this is audit evidence; update within 5 business days
- Attach any screenshots or export artifacts as GitHub Actions artifacts or SharePoint upload
2026 Test Results
Q2 2026 — June 2026
Status: Scheduled — PROPOSED Saturday June 20, 2026 (confirm by June 13; fallback June 27 — quarter ends June 30)
Test plan: Q2 DR Test Plan
After test completes, populate the table below:
| Metric | Target | Achieved | Pass / Fail |
|---|---|---|---|
| RTO — CGIRDPAZP01 (Domain Controller) | 4 hours | (populate) | (populate) |
| RTO — BIZARCAZP01 (Business App Server) | 4 hours | (populate) | (populate) |
| RTO — psql-secops-prod (SecOps DB) | 4 hours | (populate) | (populate) |
| RTO — All remaining DR instances | 8 hours | (populate) | (populate) |
| RPO — All systems | 1 hour (aspirational) / 24 hours (current) | (populate) | (populate) |
| Veeam replica boot — at least 3 tier-1 workloads | Clean boot, no manual intervention | (populate) | (populate) |
| Twingate DR path | Accessible without PROD Azure | (populate) | (populate) |
| SecOps platform recovery | Operational from PITR restore | (populate) | (populate) |
Declaration-to-operational time: (populate)
Participants: Rory, Kevin, Greg, Adriana
Scenario summary:(After test: brief narrative of what was simulated, what worked, what didn't)
Gaps identified: (After test: list gaps with severity)
Plan revisions required: (After test: what needs updating in DR failover procedure)
Q4 2026 — November/December 2026
Status: Planning — see compliance/q4-dr-test-plan-2026.md
| Metric | Target | Achieved | Pass / Fail |
|---|---|---|---|
| RTO — CGIRDPAZP01 | 4 hours | (populate) | (populate) |
| RTO — BIZARCAZP01 | 4 hours | (populate) | (populate) |
| RTO — psql-secops-prod | 4 hours | (populate) | (populate) |
| RTO — All remaining | 8 hours | (populate) | (populate) |
| RPO | 1 hour (target) | (populate) | (populate) |
| Veeam replica boot | Clean boot | (populate) | (populate) |
| Twingate DR path | Accessible | (populate) | (populate) |
Open Gaps Tracker
Gaps found during testing that have not yet been remediated. Close each gap before the next test or document a risk acceptance if remediation is not feasible.
| Gap ID | Found In | Description | Severity | Owner | Status | Resolved Date |
|---|---|---|---|---|---|---|
| DR-GAP-001 | Pre-test (known) | RPO is ~24 hours (Veeam nightly) — aspirational 1-hour RPO requires hourly replication not yet configured | Medium | Rory | Open — planned 2026 improvement | — |
| DR-GAP-002 | Pre-test (known) | Cortex XDR FQDN cortex-xdr.paloaltonetworks.com does not resolve in AWS — Cortex traffic hits Containment deny rule | Low | Rory | Open — fix: VPC resolver via Panorama | — |
| (add from Q2 test) |
Gap Severity:
- Critical — blocks recovery within RTO; must be fixed before next test
- High — significantly impacts RTO/RPO; fix within 30 days
- Medium — workaround exists; fix within 90 days
- Low — minor; fix when convenient
Historical Test Results
2025 (Pre-Formal Testing)
No formal DR tests conducted in 2025. The November 2024 ransomware incident served as an unplanned real-world DR validation. Key lessons from that event are incorporated into the current DR Failover Procedure.
Auditor Evidence Package
For the SOC2 September 2026 audit, prepare:
- This log — shows DR testing occurred and findings are tracked
- Q2 test plan (
compliance/q2-dr-test-plan-2026.md) — shows structured test scope - Test artifacts — screenshots of DR environment running, RTO timestamps, Veeam console
- Gap remediation evidence — show gaps from Q2 test were addressed before Q4 test
- DR procedure (
aws/dr-failover-procedure.md) — shows the plan that was tested
HIPAA §164.308(a)(7)(ii)(D) requires testing the contingency plan and revising it based on findings. This log + gap tracker + plan revision history satisfies that requirement.
Document History
| Date | Change | Author |
|---|---|---|
| May 2026 | Initial draft — test schedule, Q2/Q4 results tables, open gaps tracker with known pre-test gaps, historical context, auditor evidence package. | Rory |