To ensure data can be successfully restored during an incident, an organization's disaster recovery plans should be actively tested under realistic scenarios, such as a simulated ransomware attack, rather than relying solely on a written plan.

### Why this is right The action plan explicitly includes a full recovery of the most sensitive data as though it were lost in a ransomware attack. Rehearsal tests whether plans work under realistic conditions. ### The concept A written plan cannot demonstrate that data can actually be restored. A recovery exercise can expose missing backups, unclear responsibilities, excessive recovery times, or dependencies that were not considered. Care Ltd also proposes measuring mean time to recovery and comparing it with business requirements. ### Terms - **Ransomware**: malicious software that can block access to information or systems, commonly by encrypting data. - **Recovery plan**: documented arrangements for restoring systems, information, or operations after disruption. ### Remember Test restoration in practice rather than assuming that a written plan will work.