Write down every account that can delete your backups

Yes 2

Written down, with a date (a log, a screen, a document), and it meets your own plan.

Partly 1

Remembered, but not written down, or the record shows you missed your plan.

No 0

Nobody knows, or it was never done. A blank is a finding.

"None, checked on a date" counts as a record. No plan or target written down? Write your guess first, then measure: the guess is your plan.

Tap No, Partly or Yes for each question. Your score adds up as you go. Nothing you tap is saved or sent.

Five questions about your own setup

1. 1 Every account that can delete a copy

   Your answer, and where it is written down (with the date) For every place a backup copy lives (the backup software, the storage array's snapshots, a cloud storage bucket, the tape library), have you listed every account that can delete a copy or shorten how long it is kept? (A snapshot is a point-in-time copy.)

   Your answer

   No 0Partly 1Yes 2
   Score 0, 1 or 2This quarterNext quarter

   How to raise it

   Where to find it:

   The user or role screen of each place. Look for delete, expire and retention rights, not only the admin label.

   To get it to a 2:

   A dated list, one line per account per place, read from those screens and not from memory.

   What this does not prove:

   A list of roles does not prove who holds the password today.

2. 2 Any everyday login on that list

   Your answer, and where it is written down (with the date) Is any account on that list an everyday login, the same one someone uses for email? (Check the names against the company directory, the central list of staff accounts.)

   Your answer

   No 0Partly 1Yes 2
   Score 0, 1 or 2This quarterNext quarter

   How to raise it

   Where to find it:

   Compare each name on your row 1 list with the company directory. A console that signs in through the directory counts.

   To get it to a 2:

   None, checked on a date. If one is on the list, it is written down with a date to move it off, and the goal of none is your plan.

3. 3 How each one signs in

   Your answer, and where it is written down (with the date) For each account on the list, do you know what it takes to sign in: a password only, a code, or a hardware security key?

   Your answer

   No 0Partly 1Yes 2
   Score 0, 1 or 2This quarterNext quarter

   How to raise it

   Where to find it:

   The sign-in settings in each console, or the person who set it up.

   To get it to a 2:

   Every account on the list written down with how it signs in and the date you checked.

4. 4 The second role, named

   Your answer, and where it is written down (with the date) If your storage splits deleting across two roles, have you written down who holds the second role too?

   Your answer

   No 0Partly 1Yes 2
   Score 0, 1 or 2This quarterNext quarter

   How to raise it

   Where to find it:

   The array's role list. On some arrays a separate security role can remove a protected copy; on others there is no split.

   To get it to a 2:

   Named people, written down with the date. No split on your storage? Write that down with the date.

   What this does not prove:

   Two roles do not make a copy nobody can delete.

5. 5 The count, today

   Your answer, and where it is written down (with the date) Can you say how many accounts can delete your backup copies today, and whether any of them is the one you use for email?

   Your answer

   No 0Partly 1Yes 2
   Score 0, 1 or 2This quarterNext quarter

   How to raise it

   Where to find it:

   Rows 1 and 2, added up into one sentence in your own notes.

   To get it to a 2:

   The count and the answer written down and dated, and read again inside the interval your team sets. No interval written down? Write your guess (once a quarter, once a year) and score against it.