How do you evaluate the control "a restore from backup was tested this quarter" on a continuous schedule?

## Some controls describe activities, not states Most controls in an automated compliance programme are predicates over live configuration: is this bucket public, is this volume encrypted, does this instance carry an owner. You can re-derive the answer from the system as often as you like, and every run is independent evidence. A restore test is not that. It is an activity that happened at a moment. There is no field to read that says "a restore worked", and there is no schedule frequent enough to observe an event that is already over. Interviewers use this control because it exposes whether a candidate believes "continuous compliance" means literally continuous, or understands what is actually being made continuous. ## Split the activity from the check The control has two halves and they get different cadences. **The activity** - actually restoring from a backup and confirming the result - runs on its own schedule, driven by whatever risk appetite and effort the exercise demands. Nothing here becomes continuous. **The check** becomes a predicate over the evidence the activity leaves behind: > the newest successful restore-test record for this system has a completion timestamp less than 90 days old That predicate is state. It can be evaluated every night, or on every change to the evidence store, and it behaves exactly like the clock-driven controls elsewhere in the estate: it decays predictably. That is a feature. You know today which systems will breach the window in three weeks, so you can warn at 75 days, escalate at 85, and fail at 90 - and the failure, when it comes, is a scheduling failure you saw coming, not a surprise. This reframing is general. "Access reviews performed quarterly", "incident response exercised annually", "a penetration test within the last year" all convert the same way: the control becomes *recency of the most recent qualifying record*. ## The record is the entire control Once the check reads a record rather than the system, the record's integrity is the control. Weak versions of this are worse than no automation, because they produce a confident green from a box someone ticked. What a defensible record carries: - **Emitted by the exercise, not typed afterwards.** If the restore job writes the record as its final step, the record cannot exist without the work. If a human fills a form, you are measuring form-filling. - **Identity of what was tested.** Which system, which backup - specific enough that the record cannot be quietly reused for a different system next quarter. - **The verification, not just the completion.** "The restore job exited zero" is far weaker than "the restored dataset passed these integrity checks". A restore that produces an unusable database is a failed test that most naive records score as a pass. - **Environment.** A restore into a scratch environment proves something different from a restore into a like-for-like one. If the record does not say, the check silently accepts the weaker exercise. - **Tamper-evidence and retention.** The store must be append-only enough that the record cannot be back-dated, and retained at least as long as the reporting window - a control that reads a record which has been rotated away reports unknown, not pass. ## Be honest about what the verdict means A state control re-derives its answer from the system on every run. This one asks: *did someone assert, once, that this happened?* Those are different confidence levels and mixing them into a single green percentage overstates the second. It is worth marking evidence-backed controls as such in reporting, so the reader knows which greens are re-measured nightly and which are the memory of a past event. The other thing to say plainly: the check verifies recency and record integrity. It cannot verify quality. Whether the restore exercise was realistic - full dataset or a token table, cold start or a warm standby already running - is a question about the exercise's design, and no cadence choice touches it. What the automation buys you is that the exercise cannot be skipped without going red on a date you can predict. ## What this looks like in an interview Work through it in this order: name that the control is an event rather than a state; convert it to a recency predicate over an authoritative record; specify what the record must contain and who writes it; add the graded warning before expiry; and finish by conceding what the automation does not prove. A candidate who says "we run it nightly" without noticing that nothing observable happens nightly has missed the question entirely.