{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C09: Demonstrate recovery in an authorised test\nRisk addressed: A recovery plan relies on backups or dependencies that have not been shown to restore the required service or information.",
    "operation": "In this example, the responsible technical owner conducts an authorised restoration test within agreed boundaries, checks the recovered outcome and records failed assumptions and follow-up work.\nSuggested review trigger: a significant service or backup change, an unsuccessful test or the chosen recovery-testing programme.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The approved test objective, environment, scope and safeguards.\n- Restoration records showing what was recovered and what checks were performed.\n- The outcome, limitations, unresolved dependencies and follow-up test plan.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Select a claimed successful recovery test; compare the result with its stated objective and inspect the evidence of usable recovery. Identify elements supported only by discussion or assumption.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: A successful backup job is presented as restoration evidence, or recovered information has not been checked for usability.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}