Write and review disaster recovery and backup restore playbooks. Use whenever the user asks for a DR plan, RPO/RTO targets with restore evidence, a failover drill, ransomware restore steps, or "can we restore" — not a single-alert runbook, live incident command, or SLA wording alone.
