Resilience & recovery · Methodology
DR3: a new way to test how ready you are to recover
A pharmaceutical client lost 350,000 records and needed 10 days to recover them. I co-created the framework that helps other organisations find their gaps before an incident does.
- My role
- Principal Technical Account Manager
- Organisation
- Own from Salesforce
- When
- March 2024 – present
- Reach
- 150+ organisations
What happened
A multinational pharmaceutical and healthcare provider, with around 60 Salesforce orgs, suffered a major data loss. Some 350,000 records disappeared and it took ten days to recover them inside a single org. Its recovery time objectives were missed and critical operations were disrupted.
The after-action review found gaps in technology, people and process. There was no cohesive recovery strategy, backups were rarely tested, and finding the root cause and coordinating the recovery took far too long.
What I set out to do
Create an assessment methodology that works for technology, people and processes, and that technical and non-technical stakeholders can both follow. It needed a simple 1–5 maturity scale and had to line up with an established standard, NIST Cybersecurity Framework 2.0, so it would be trusted. And it needed a training programme so Technical Account Managers could run assessments confidently themselves.
What I did
I worked with a research partner in digital forensics to co-create DR3™, built around seven lenses:
- Govern: legal, audit and risk requirements are met.
- Identify: you know where your mission-critical data lives.
- Protect: segregated backups, and recovery you have actually tested.
- Detect: monitoring that spots data loss or corruption early.
- Respond: an incident response plan that has been rehearsed.
- Recover: downtime kept inside your recovery time objectives.
- Report: actions and assessments documented for continuous improvement.
I ran interactive workshops with client stakeholders, wrote an assessment report with an executive summary, scoring matrix and recommended actions, and built the curriculum that turned TAMs into certified DR3 Practitioners.
What changed
DR3™ has been adopted by more than 150 organisations, and 26 TAMs are certified practitioners.
The proof
After the assessment the client rewrote its playbooks, trained across teams and started testing regularly. Three months later a misconfigured integration put 6,000 patient records at risk. This time they invoked the new procedures and recovered them in 3 hours, not 10 days.
Doing it responsibly
No personal data was exposed or copied during assessments. Workshops ran under strict access controls and confidentiality agreements, and the methodology was designed with the UK Data Protection Act, GDPR, CCPA, DORA and HIPAA in mind. Reports use plain language, and the tone is about resilience and improvement, never blame.