A product can add capability, but it cannot decide your priorities or operate itself. These questions help leadership and technical teams find the gaps between policy, tools, people, and recovery.
What must continue to work?
Name the services, information, and business processes whose loss would cause the most harm. Identify the owners and the technical dependencies behind each one.
Ask how long each service can be unavailable and how much recent data can be lost. Those answers should guide backup, recovery, resilience, and response priorities.
Who has access, and why?
Check how employees, administrators, contractors, suppliers, and service accounts receive access, how it changes with their role, and how it is removed.
Review multifactor authentication, privileged access, dormant accounts, emergency access, and the evidence produced by access reviews.
Can the team see and act?
List the alerts and monitoring tools already in place, who reviews them, which events need escalation, and what happens outside business hours.
A detection that nobody owns is not a working control. Test the path from signal to decision to containment.
Has recovery been proven?
Review backup isolation, restore tests, credentials needed during an outage, vendor dependencies, communication plans, and the order in which systems return.
Run a short tabletop exercise with leaders and technical staff. Record decisions that were unclear and fix the plan while the pressure is low.