Appearance
BGKIT — Offline Backup Verification in DR Test Checklist
Purpose
This is a placeholder note so the DR test checklist — when it is written — includes offline backup verification as a first-class step. The formal DR test checklist (runbooks/dr-test-checklist.md) does not yet exist in main; it is being produced by a separate sprint. This note carries the BGKIT-012 requirement forward so it is not lost during that work.
Related story: BGKIT-012. Related project: Break-Glass Offline Kit (BGKIT).
What must be added to the DR test checklist
When runbooks/dr-test-checklist.md is created, insert a new section — suggested placement is immediately after the Veeam replica boot test and before the Recovery Services Vault restore, because offline-backup is the last-resort tier below both online backups.
Proposed section: Offline Backup Verification
N. Offline Backup Verification
The offline backup tier is the final backstop — immutable media that is disconnected from all production networks and encryption keys. It must be readable and decryptable using only the break-glass offline kit, with no dependency on Azure, AWS, or production identity.
- [ ] Retrieve the current offline backup media from its documented physical location (safe / escrow / safety deposit box per BGKIT procedure)
- [ ] Confirm media integrity (no physical damage, no write errors on mount)
- [ ] Mount the media on an isolated workstation — no network, no corporate identity signed in
- [ ] Decrypt a sample dataset using only the offline kit's documented keys and passphrases (do not use any production secret manager)
- [ ] Verify at least three files from different source systems restore cleanly and match their recorded hashes
- [ ] Record decryption time and restore time in the DR test RTO table
- [ ] Return media to its documented physical location and confirm seal / tamper-evidence is re-applied
- [ ] Note the date in the offline-backup rotation log so the next rotation is scheduled
Pass criteria: Media is physically intact, decryption works using only the offline kit, sample files restore with matching hashes, RTO within target.
Fail criteria: Any of the above fails — raise a CRITICAL BGKIT story, schedule an immediate re-rotation of offline media, and re-run this section before closing the DR test as PASS.
Why a note file instead of editing the checklist
When this story was picked up, runbooks/dr-test-checklist.md did not yet exist in the main branch of bedrock-docs. Creating a new checklist would conflict with the parallel sprint that is authoring the canonical checklist. Leaving this note ensures the author of that checklist — or the next reviewer — integrates the offline-backup section at the right place.
Action required
On the next PR that adds runbooks/dr-test-checklist.md:
- Incorporate the section above (or equivalent) into the new checklist
- Delete this placeholder file in the same PR
- Reference story BGKIT-012 in the commit message so the linkage is preserved
SOC2 / HIPAA Mapping
- SOC2 A1.2 — environmental protections and backup recovery testing
- HIPAA 164.308(a)(7)(ii)(B–D) — disaster recovery plan and testing