A recovery point the board could sign off

The challenge

Backups ran nightly and were assumed to work. Nobody could say how long a full recovery would take, and the question had started appearing in audits.

What we did

We agreed a four-hour RTO and a fifteen-minute RPO, then designed to it: Proxmox Backup Server with verified jobs, ZFS replication to a second site, and a written runbook. The first drill took six hours and found two broken assumptions.

The result

The second drill came in at three hours forty minutes. Drills now run quarterly and the result goes to the board whether or not it went well.