> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alignr.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Backup and recovery
> Backup protection, job health, recency and restore testing.
This category contains **5 automated control definitions** and **1 manual check** across the sources named below. Similar controls from different standards are listed separately because names, thresholds or severity can differ.
Whether the seeded Alignr Baseline is available depends on how your workspace was provisioned. Library templates are copied as disabled drafts. See [Choose a baseline](/controls/baselines/overview) before enabling anything.
## Automated controls
Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.
Each selected server should have a recorded backup product.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Devices reported as managed by an RMM.
The operating-system name must also match the case-sensitive pattern `Server`.
**What the result tells you**
Recorded product presence is not a successful backup or a tested restore. Missing evidence must be investigated rather than treated as passing.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Device management** (`device_managed_by`) equals `"rmm"`.
* Filter: **Operating system** (`os_platform`) matches the case-sensitive pattern `"Server"`.
**Expected evidence**
* **Backup protection provider** (`backup_protected_by`) has a non-null observed value.
**Required predicates:** `backup_protected_by`, `device_managed_by`, `os_platform`.
```json theme={null}
{
"match": {
"predicate": "device_managed_by",
"object": "rmm"
},
"where": [
{
"fact": "os_platform",
"op": "matches",
"value": "Server"
}
],
"expect": [
{
"fact": "backup_protected_by",
"op": "exists"
}
],
"severity": "high",
"title": "Server has no backup product recorded",
"evidence": [
"device_managed_by",
"os_platform",
"backup_protected_by"
]
}
```
Each selected job should report a healthy status.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Backup jobs with a recorded status.
**What the result tells you**
The expected state is the normalised value ok. Review the job/workload identity and timing; this is not a restore test.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Backup job state** (`backup_job_state`) has an observation.
**Expected evidence**
* **Backup job state** (`backup_job_state`) equals `"ok"`.
**Required predicates:** `backup_job_state`.
```json theme={null}
{
"match": {
"predicate": "backup_job_state"
},
"expect": [
{
"fact": "backup_job_state",
"op": "eq",
"value": "ok"
}
],
"severity": "high",
"title": "Backup job is not reporting ok",
"evidence": [
"backup_job_state"
]
}
```
Each selected workload should have a successful-backup timestamp within the configured day window.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Workloads with a recorded backup product.
**Default settings**
| Setting | Default | Allowed range |
| --------------------------------- | ------- | ------------- |
| Must have completed within (days) | `1` | 1–30 |
Client overrides can change these values. [Check the effective settings](/controls/parameters) when interpreting a result.
**What the result tells you**
This measures backup recency, despite any title mentioning a retention window. It does not inspect retention policy, recovery time or restored-data integrity.
The time window includes timestamps before or after now. Investigate unexpected future timestamps.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Backup protection provider** (`backup_protected_by`) has an observation.
**Expected evidence**
* **Last successful backup** (`backup_last_successful_at`) is within this many days of now (past or future): parameter `max_age_days`.
**Required predicates:** `backup_last_successful_at`, `backup_protected_by`.
```json theme={null}
{
"match": {
"predicate": "backup_protected_by"
},
"expect": [
{
"fact": "backup_last_successful_at",
"op": "within_days",
"value": {
"param": "max_age_days"
}
}
],
"severity": "high",
"title": "Protected workload's backup is overdue",
"evidence": [
"backup_protected_by",
"backup_last_successful_at"
]
}
```
Each selected job should report a healthy status.
Part of **BIOS Backup Health**.
**Applies to**
Backup jobs with a recorded status.
**What the result tells you**
The expected state is the normalised value ok. Review the job/workload identity and timing; this is not a restore test.
| Setting | Value |
| ----------------- | ------------------ |
| Standard | BIOS Backup Health |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Backup job state** (`backup_job_state`) has an observation.
**Expected evidence**
* **Backup job state** (`backup_job_state`) equals `"ok"`.
**Required predicates:** `backup_job_state`.
```json theme={null}
{
"match": {
"predicate": "backup_job_state"
},
"expect": [
{
"fact": "backup_job_state",
"op": "eq",
"value": "ok"
}
],
"severity": "high",
"title": "Backup job is not healthy",
"evidence": [
"backup_job_state"
]
}
```
Each selected workload should have a successful-backup timestamp within the configured day window.
Part of **BIOS Backup Health**.
**Applies to**
Workloads with a recorded backup product.
**Default settings**
| Setting | Default | Allowed range |
| ------------------------- | ------- | ------------- |
| Maximum backup age (days) | `1` | 1–30 |
Client overrides can change these values. [Check the effective settings](/controls/parameters) when interpreting a result.
**What the result tells you**
This measures backup recency, despite any title mentioning a retention window. It does not inspect retention policy, recovery time or restored-data integrity.
The time window includes timestamps before or after now. Investigate unexpected future timestamps.
| Setting | Value |
| ----------------- | ------------------ |
| Standard | BIOS Backup Health |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Backup protection provider** (`backup_protected_by`) has an observation.
**Expected evidence**
* **Last successful backup** (`backup_last_successful_at`) is within this many days of now (past or future): parameter `days`.
**Required predicates:** `backup_last_successful_at`, `backup_protected_by`.
```json theme={null}
{
"match": {
"predicate": "backup_protected_by"
},
"expect": [
{
"fact": "backup_last_successful_at",
"op": "within_days",
"value": {
"param": "days"
}
}
],
"severity": "high",
"title": "Protected workload backup is overdue",
"evidence": [
"backup_protected_by",
"backup_last_successful_at"
]
}
```
## Manual checks
These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.
**Review every 30 days** · BIOS Backup Health
Restore a representative workload, record recovery time and integrity evidence, and reconcile the result with the agreed RTO/RPO.
**Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
## Investigate a result
Confirm the client and the account, device or other item being assessed. Check the source, observation time and effective settings, then compare the recorded evidence with the expectation. Missing evidence needs investigation; a change to the environment requires a separate review.
## Next steps
[Create a custom control](/controls/create-custom) · [Parameters and client overrides](/controls/parameters) · [Record a manual check](/controls/manual-checks)