Security · Buyer guide
The handover folder contains “final-backup”. Months later, nobody knows its device, release or whether it contains everything recovery needs. A backup is useful when its identity, custody and restore conditions are clear. Put these requirements in the scope before calling the installation complete.
Identify every recovery artifact
Record device name, model, asset reference, software version, capture time and configuration revision. Separate the as-built recovery copy from a template or redacted document. Provide an index so the person handling an incident can locate the right file without guessing.
Fortinet’s firmware-reload guidance includes current-configuration backup and restoration within the relevant procedure. Fortinet: configuration backup and restore guidance Use exact product/release instructions for your recovery plan; files from different platforms or versions should not be assumed interchangeable.
Separate documentation from recovery
You may need a sanitised record for review and a protected artifact for an authorised restore. State which is which. Ask what certificates, keys, subscriptions, account access or external services are also required. Do not assume every dependency is contained in one export.
Agree controlled storage and authorised retrieval. Handle required decryption material separately from a widely shared document folder. Public articles and review illustrations should never contain real configurations, credentials or internal addressing. The photographed appliance illustrates the class of equipment, not the contents of an actual customer network.
Define the restore demonstration
Ask whether recovery can be demonstrated in a suitable isolated environment. Record hardware, release, procedure and actual outcome, including differences that prevent exact equivalence. Checking a file exists is a different assurance level from exercising its supported recovery path.
Never restore production merely to tick a checklist. Responsible staff must approve the method, window and rollback for any operation. Where an isolated test is unavailable, retain that limitation and specify what review was completed instead. Do not call an untested plan proven recovery.
Give the organisation continuing ownership
Name who updates the recovery copy after an accepted change and checks the index. At contractor handover, confirm the organisation retains required access and knows which services remain under a supplier’s account. Agree the transition process when a maintainer changes.
For RIAM handover discussions, provide the device estate, recovery objective and custody policy. Request a named recovery owner and list of untested dependencies. That creates an operational handover instead of a collection of files nobody knows how to use.
Recovery artifact register
Use this worksheet in the supplier discussion. Replace example entries with your project information; it is not a completed survey or approved design.
| Artifact | Identity / custody | Evidence |
|---|---|---|
| Recovery configuration | Device, release, revision and capture time | Securely retrievable |
| As-built documentation | Sanitised and labelled | Matches accepted installation |
| External dependency | Owner and recovery access | Available or explicit gap |
| Restore exercise | Approved isolated target | Actual result / limitations |
Questions buyers ask
Does a backup file prove recovery?
No. Check identity, completeness, access and restore conditions.
Is a redacted document a restore file?
Not necessarily; label the two deliverables separately.
Should production be restored for a test?
Only under separately approved controls; use suitable isolation where possible.
Can another model use the same file?
Check the manufacturer-supported recovery or migration process.
Who owns backups after handover?
A named organisation owner with custody, access and update responsibilities.
Discuss your requirements with RIAM’s security team, or send a project brief. Scope, availability and commercial terms are confirmed in the project proposal.
Manufacturer references
Research checked 24 October 2026. Use the exact selected model, release and applicable project documents.
