What It Delivers
Backup Architecture Review
Current backup coverage assessed for every workload: M365 data, on-premises systems, cloud VMs, and critical databases. The gaps that consistently appear — M365 data that employees believe Microsoft backs up but that has no independent point-in-time backup, backup systems reachable from the same network as production, backup credentials stored in the same password manager as everything else — are found and documented before an attacker finds them first.
Immutable Backup Deployment
Immutable, off-network backup deployed for critical workloads. Ransomware operators delete or encrypt backups before they hit production — a backup reachable from the compromised estate is not a backup. Immutability ensures the backup cannot be modified or deleted even by a fully compromised admin account.
Disaster Recovery Runbooks
Step-by-step recovery procedures written for every critical workload — including the scenarios nobody documents: AD forest recovery, M365 tenant configuration restore, and cloud infrastructure rebuild from ASTRAL baseline. Each runbook is tested, not just written. A runbook that has never been executed is a hypothesis.
Tabletop Exercise
A structured scenario walkthrough — typically a ransomware incident or identity compromise — run with the actual response team. Gaps in communication, decision authority, and technical procedure surface in a tabletop, not in a live incident. Every gap found in the exercise is a gap not found under pressure.
ASTRAL Baseline as Rebuild Blueprint
The ASTRAL Git repository — capturing your M365 and Intune configuration — becomes your authoritative rebuild baseline. After a catastrophic configuration failure or tenant compromise, "what do we restore to?" has a deterministic answer. The restore pipeline applies the known-good state without manual reconstruction from memory.
The Antifragile Recovery Principle
A robust organisation survives an incident and comes back the same. An antifragile one comes back different — with a shorter kill chain, a tested runbook it now knows works, and one more scenario it has rehearsed. Every incident that runs through this module’s feedback loop makes the next one cheaper. The tabletop is not a compliance checkbox; it is the cheapest incident you will ever have.
Scope and Prerequisites
| Duration | 30–60 days |
| Environment | M365 and/or on-premises |
| Prerequisites | ASTRAL deployed (Module 1 or 3) for the configuration baseline; inventory of critical workloads |
| Natural follow-on | Module 11 (Blue/Purple Team) to build the detection capability that feeds the recovery loop |
Know you can recover before you need to
An untested backup is simultaneously fine and worthless. Module 7 tells you which one yours is — before the incident does.