How to use
Quarterly, with the dependency drawing on the table and the custody register open beside it. Budget the fifty minutes for two people: one who administers the estate day to day and one who does not, because several items turn on a separation the first person cannot assess about themselves.
Most of the sheet is answerable from records. Four items are not, and they are the reason the sheet exists — the date the bootstrap path was last walked, the date escrowed material alone last opened a repository, the condition of the media in custody, and the custody names checked against who still works here. Answered from memory, each is a fail.
Where the numbers come from
The escrow figure is a restore performed with the production credential withheld — not a confirmation that an escrowed copy exists somewhere. An intact repository whose passphrase died with its host answers in two lines:
$ restic snapshots Fatal: wrong password or no key found
>>> exit code: 12A passphrase production never held answers differently on the same repository, and this is the answer the item wants to see dated:
$ restic --password-file /work/recovery-pass restore latest --target /work/rec restoring snapshot b96ba7cf of [/work/prod2] at 2026-08-28 14:04:52.481565631 +0000 UTC by root@17dffded9807 to /work/rec
Summary: Restored 3 files/dirs (38 B) in 0:00
>>> exit code: 0The cycle count is read off the drawing by walking it, never estimated from memory. The custody figure is counted from the register and then reconciled against the current staff list, because those are two different numbers and only the second one matters. The bootstrap date is the day somebody completed the written sequence somewhere that was not production — not the day the document was last reviewed.
Access this needs
Read access to the dependency drawing, the custody register, the repository key inventory and the service start-order documentation. Nothing here requires the ability to change a running system.
Physical access to at least one custody location, or a custodian willing to open one while the reviewer watches: the condition of the media cannot be answered from a register.
Enough to run the decryption drill against scratch space: the escrowed material and nothing else. That restriction is the measurement.
A current staff list, or somebody who can confirm four names against one. This is usually the slowest access to arrange and the quickest item to fail.
What the review produces
A dated sheet naming both reviewers and the disposition of every item, carrying four numbers: how many cycles the drawing contains, how many of those have a designated outside edge, how many months since the bootstrap path was walked, and how many months since escrowed material alone opened a repository.
Attach the cycle list. It is short, it is usually the part nobody had written down before, and it is the finding most likely to change an architecture rather than a document.
Attach the start-order credential list too, with expiry dates beside it. Produced calmly once, it is the difference between a recovery that stalls on a certificate nobody thought about and one that does not.
A failing critical item accepted rather than fixed needs a named acceptor and a date to revisit. “The custodians are the administrators” is a decision somebody is making.
Sign-off
- Reviewer: ____ Date: ____
- Second reviewer, not a production administrator: ____ Date: ____
- Key custodian: ____ Date: ____
- Service owner: ____ Date: ____
Every critical item must pass. A failing critical item is a blocker rather than a note for the next quarter: record the date, the reviewer, and the name of whoever accepted the residual risk.