Backup and recovery

Servers are protected by a backup product

Explanation
Definition

Each selected server should have a recorded backup product.Part of Alignr Baseline (seeded).Applies toDevices reported as managed by an RMM.The operating-system name must also match the case-sensitive pattern Server.What the result tells youRecorded product presence is not a successful backup or a tested restore. Missing evidence must be investigated rather than treated as passing.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Suggest only

Population conditionDevice management (device_managed_by) equals "rmm".

Filter: Operating system (os_platform) matches the case-sensitive pattern "Server".

Expected evidence

Backup protection provider (backup_protected_by) has a non-null observed value.

Required predicates: backup_protected_by, device_managed_by, os_platform.

{
  "match": {
    "predicate": "device_managed_by",
    "object": "rmm"
  },
  "where": [
    {
      "fact": "os_platform",
      "op": "matches",
      "value": "Server"
    }
  ],
  "expect": [
    {
      "fact": "backup_protected_by",
      "op": "exists"
    }
  ],
  "severity": "high",
  "title": "Server has no backup product recorded",
  "evidence": [
    "device_managed_by",
    "os_platform",
    "backup_protected_by"
  ]
}

Backup jobs complete without error

Explanation
Definition

Each selected job should report a healthy status.Part of Alignr Baseline (seeded).Applies toBackup jobs with a recorded status.What the result tells youThe expected state is the normalised value ok. Review the job/workload identity and timing; this is not a restore test.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Suggest only

Population conditionBackup job state (backup_job_state) has an observation.Expected evidence

Backup job state (backup_job_state) equals "ok".

Required predicates: backup_job_state.

{
  "match": {
    "predicate": "backup_job_state"
  },
  "expect": [
    {
      "fact": "backup_job_state",
      "op": "eq",
      "value": "ok"
    }
  ],
  "severity": "high",
  "title": "Backup job is not reporting ok",
  "evidence": [
    "backup_job_state"
  ]
}

Backups complete within the retention window

Explanation
Definition

Each selected workload should have a successful-backup timestamp within the configured day window.Part of Alignr Baseline (seeded).Applies toWorkloads with a recorded backup product.Default settings

Setting	Default	Allowed range
Must have completed within (days)	`1`	1–30

Client overrides can change these values. Check the effective settings when interpreting a result.What the result tells youThis measures backup recency, despite any title mentioning a retention window. It does not inspect retention policy, recovery time or restored-data integrity.The time window includes timestamps before or after now. Investigate unexpected future timestamps.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Suggest only

Population conditionBackup protection provider (backup_protected_by) has an observation.Expected evidence

Last successful backup (backup_last_successful_at) is within this many days of now (past or future): parameter max_age_days.

Required predicates: backup_last_successful_at, backup_protected_by.

{
  "match": {
    "predicate": "backup_protected_by"
  },
  "expect": [
    {
      "fact": "backup_last_successful_at",
      "op": "within_days",
      "value": {
        "param": "max_age_days"
      }
    }
  ],
  "severity": "high",
  "title": "Protected workload's backup is overdue",
  "evidence": [
    "backup_protected_by",
    "backup_last_successful_at"
  ]
}

Backup jobs report healthy

Explanation
Definition

Each selected job should report a healthy status.Part of BIOS Backup Health.Applies toBackup jobs with a recorded status.What the result tells youThe expected state is the normalised value ok. Review the job/workload identity and timing; this is not a restore test.

Setting	Value
Standard	BIOS Backup Health
Severity	High
Declared autonomy	Suggest only

Population conditionBackup job state (backup_job_state) has an observation.Expected evidence

Backup job state (backup_job_state) equals "ok".

Required predicates: backup_job_state.

{
  "match": {
    "predicate": "backup_job_state"
  },
  "expect": [
    {
      "fact": "backup_job_state",
      "op": "eq",
      "value": "ok"
    }
  ],
  "severity": "high",
  "title": "Backup job is not healthy",
  "evidence": [
    "backup_job_state"
  ]
}

Protected workloads back up daily

Explanation
Definition

Each selected workload should have a successful-backup timestamp within the configured day window.Part of BIOS Backup Health.Applies toWorkloads with a recorded backup product.Default settings

Setting	Default	Allowed range
Maximum backup age (days)	`1`	1–30

Setting	Value
Standard	BIOS Backup Health
Severity	High
Declared autonomy	Suggest only

Population conditionBackup protection provider (backup_protected_by) has an observation.Expected evidence

Last successful backup (backup_last_successful_at) is within this many days of now (past or future): parameter days.

Required predicates: backup_last_successful_at, backup_protected_by.

{
  "match": {
    "predicate": "backup_protected_by"
  },
  "expect": [
    {
      "fact": "backup_last_successful_at",
      "op": "within_days",
      "value": {
        "param": "days"
      }
    }
  ],
  "severity": "high",
  "title": "Protected workload backup is overdue",
  "evidence": [
    "backup_protected_by",
    "backup_last_successful_at"
  ]
}

Test a representative restore

Review every 30 days · BIOS Backup HealthRestore a representative workload, record recovery time and integrity evidence, and reconcile the result with the agreed RTO/RPO.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Start here

Explore Alignr

Backup and recovery

Automated controls

Manual checks

Investigate a result

Next steps

​Automated controls

​Manual checks

​Investigate a result

​Next steps

Automated controls

Manual checks

Investigate a result

Next steps