The five layers of cloud recovery

What are the five layers?

1. Data. Volumes, databases, object storage. This is what backup products restore, and what most recovery tests check.
2. Configuration. The settings of managed services: database parameters, queue and function settings, Kubernetes cluster settings, load balancer rules. Without them, restored data may have nowhere correct to run.
3. Network. VPCs or virtual networks, subnets, route tables, security groups, network ACLs, firewall rules, private endpoints.
4. Identity. IAM roles and policies, instance profiles, service accounts, and the configuration of an external identity provider such as Okta or Entra ID.
5. DNS. The records and zones that send users and services to the right place.

Why does the order matter?

The layers depend on each other from the bottom up. Identity and network come first, because no service can start or be reached without them. Configuration follows, then data, and DNS last, when you are ready to move traffic. A plan that restores data first often waits on the other four.

How do vendors cover the layers?

Our recovery scope matrix marks each ranked vendor as restored, partial or not covered on each layer, from the vendor's own public material. The pattern is consistent: data backup platforms such as Veeam and Cohesity are strongest on data, while Firefly, ControlMonkey, Arpio and Commvault Cloud Rewind document more of the other four. The matrix is not a test result, and the ranking method explains how it is built.

What should you take from this lesson?

When you read a recovery plan or a vendor page, ask which of the five layers it covers and how each one is captured. If the answer for network, identity or DNS is "we would rebuild it by hand", that is the part of the plan to test first.