War-game a backup retention ladder by testing whether class ages, restore proof, and exception deadlines still shrink soft coverage when several apps share one vault and the next cost cut is close.
Retention ladders fail when "retained" means a checkbox without a decision artifact, when teams dual-count a restore as both requested and complete, and when money paths still pin to one short class because the map is incomplete. The review needs one written inventory of backup classes, one owner who can deny a risky cut, and a documented consequence when a failed restore ages past the deadline.
Write the ladder packet before the cut window opens
List classes by data type, retention days, restore target, last drill reason, owner of record, and evidence required to keep the class. Attach open findings, overdue restores, and any emergency retention extension in the last quarter. Name which classes are out of scope and why. If a payment ledger is omitted, show the residual risk in the same packet.
Decide the allow, revise, or hold outcomes in advance. Include the fields that compute stale-retention status so two reviewers reach the same label from the same exports.
Pressure the evidence, not the diagram
| Claim | Evidence required | Fail condition |
|---|---|---|
| Class is retained as claimed | Named vault export and age sample with a measured pass | Map is empty or still points to a single untested short class |
| Restore is complete | Drill export showing usable data for the claimed RTO | Ticket closed while export still shows a failed restore |
| Exception is unique | Sample holds proving no silent permanent keep | Exception invents uniqueness legal never signed |
| Override is controlled | Logged use with time-bound restore of policy | Shared override or unlogged use |
Walk four cases in Pingpong: a ledger still pinned to a seven-day class, a restore that left a pricing table incomplete, an exception that mixed tenant buckets, and a request to skip an admin archive because traffic is rare. For each case, start from the documented ladder language. Ask who can extend a cut window and which export proves restore. Any step that depends on an unnamed person becomes a ladder condition.
Replay one prior restore incident under the proposed rules. If the incident would still age without a reverse owner, revise the rules before calling the ladder ready.
Pair this review with the storage ops lead seat and a restore drill SLA stress test. Broader backup planning often needs a backup plan stress test. More operating decisions live in the war-game decisions hub.
Close the cycle only when retained and blocked labels can be reproduced from stored exports without a verbal override.