Cloud disaster recovery buyer's checklist: 24 questions for vendors

Short answer

Twenty-four questions in six groups to put to any cloud disaster recovery or infrastructure recovery vendor. Ask for a live recovery of one of your own applications during the trial; it answers many of them at once.

Ranking current as of September 2026 · By the Cloud Resilience Vendors research desk

cloudresiliencevendors.com · Buyer's checklist · Ranking current as of September 2026

What will it capture?

  1. 1. Which resource types, per cloud, can you restore? Can we see the coverage list?
  2. 2. Do you capture IAM roles and policies, DNS records and network rules, or only compute and storage?
  3. 3. Do you capture SaaS configuration such as our identity provider or CDN?
  4. 4. How do you capture dependencies between resources?

How does the rebuild work?

  1. 5. Can you rebuild into a different region? A different account or subscription?
  2. 6. Is the restore a single orchestrated step, or does it generate code we review and apply?
  3. 7. What happens to resources your tool does not support?
  4. 8. Can we recover into a clean, isolated account after ransomware?

What about the data?

  1. 9. Do you back up data contents, or only configuration?
  2. 10. If only configuration, which data backup products do you work alongside?
  3. 11. What is the RPO for configuration, and separately for data?
  4. 12. Are captured copies immutable, and where are they stored?

How do we know it works?

  1. 13. Can we run a recovery test without touching production?
  2. 14. Will you run a recovery of one of our applications during the trial and let us time it?
  3. 15. What RTO do you state, and under what conditions was it measured?
  4. 16. Do you report recovery readiness per application over time?

Is it safe to run?

  1. 17. What permissions does your service need in our accounts?
  2. 18. Can the recovery copies be deleted or altered by someone with our admin credentials?
  3. 19. Do you record who changed what and when, and detect drift from a known-good state?
  4. 20. Which compliance evidence can you export for auditors?

What will it cost?

  1. 21. Is the recovery capability in the base tier or a higher one?
  2. 22. What is the pricing unit: assets, resources, core resources, TB?
  3. 23. What cloud costs does a recovery environment add?
  4. 24. Is there a trial or assessment, and what does it include?

Where vendors answer these on public pages, our profiles link to the answer. Where they do not, our profiles say 'Not published'.