START WITH THE PRODUCT STEPS Read START-HERE.txt first. It states the actual source acquisition, access/privacy limits, manual field mapping and exact next prompt. The original file templates and synthetic examples below are supporting review aids. Some paths need separately supplied documents or source text; a blank worksheet is not a native export or completed integration. S13: Expose gaps in backup coverage and restore-test evidence Starter kit Status: Proposed / not tested PURPOSE Monthly IT review or new data system → compare approved data-location inventory with existing backup-job evidence and actual restore-drill records → coverage matrix, stale/failed-job exceptions and missing recovery-test evidence. PREREQUISITES 1. IT supplies system ID, owner, data location/class, approved recovery objectives, backup product/job ID, last successful run, exclusions, evidence timestamp and actual restore-drill date/result. Spreadsheet joins; existing administrative exports only. SaaS coverage is unknown until its administrator supplies evidence. Sync success alone is not backup proof. 2. Synthetic files first. Real use requires firm-approved access, privacy, processing terms, retention controls, export coverage and a named reviewer. 3. Prepare any required original files or rendered evidence separately. This kit does not configure accounts, connectors or live actions. FILES AND FORMATS data-locations.csv: system_id, owner_alias, data_class, location_alias, approved_recovery_objective, approved_job_freshness_hours, approved_restore_review_date backup-status.csv: system_id, job_id, coverage_status, last_success_utc, job_status, exclusions, evidence_timestamp, source_ref restore-drills.csv: system_id, drill_date, result, evidence_ref scope.txt: as-of UTC and export coverage Files without .example are blank input worksheets; CSV templates contain headers only. .example files contain invented records for the dry run. Text input .txt files contain blank labeled fields. Use the original base filename when supplying an example to the prompt, or explicitly map the example filename to that input. CSV files are UTF-8 with comma delimiters, quoted fields where needed, and CRLF row endings. Preserve identifiers as text when importing into Excel. Blank means missing or unresolved, never a zero or a pass. Multi-value fields use a pipe only where the fixture scope says so. SETUP AND DRY RUN 1. Copy this kit to an approved working folder. Keep examples separate from any real exports. Do not upload client, privileged, personal, credential or financial-account data to an unapproved service. 2. Read the .example text policy/scope files and all .example.csv inputs together. They define this fixture only. For a real pilot, fill the blank templates from approved exports without changing headers and obtain approved policy values. 3. Use native read-only exports, exact joins and arithmetic for deterministic checks. This kit includes no executable automation, OAuth setup, live-action instructions or importable Make blueprint. 4. Give only the approved prepared inputs to a firm-approved text assistant and use the recipe prompt below. Keep source IDs, source row numbers and unresolved evidence visible. 5. Compare the proposed result with expected-fixture-result.txt. Verify every listed issue and that the prompt invents no missing evidence. The expected file describes assertions, not a performed workflow run. 6. Have the named reviewer check source evidence and record remaining questions before any separately authorized action. RECIPE PROMPT Compare these sanitized data-location, backup-status and restore-drill tables by system ID. Use only the supplied recovery objectives and freshness thresholds. List covered, explicitly excluded and unknown systems, stale or failed jobs, and missing restore-test evidence. Link every finding to a source row and timestamp. Do not infer recoverability from a successful job, promise complete protection, change backup settings or perform a restore. Prepare questions for the IT owner. INPUTS data-locations.csv: system_id, owner_alias, data_class, location_alias, approved_recovery_objective, approved_job_freshness_hours, approved_restore_review_date backup-status.csv: system_id, job_id, coverage_status, last_success_utc, job_status, exclusions, evidence_timestamp, source_ref restore-drills.csv: system_id, drill_date, result, evidence_ref; scope.txt: as-of UTC and export coverage OUTPUT backup-review.csv: system_id, coverage_gap, job_status, last_success_utc, restore_evidence, review_due, source_refs, uncertainty, IT_question. No backup or restore is performed. Use only these synthetic or firm-approved inputs and preserve source row/page IDs. Keep missing or conflicting evidence unresolved. Return a draft for the named reviewer. Do not send messages, connect accounts, change records or permissions, move money, or make legal decisions. Keep source files unchanged. List missing prerequisites before continuing. REVIEW CHECKLIST [ ] Headers match the exact input schema and the export covers the stated scope [ ] Synthetic example files were used alone for the first dry run [ ] Every output finding retains its original source ID/row/page reference [ ] Missing keys, contradictions, unavailable originals and ambiguous dates remain unresolved [ ] Every expected fixture finding is present; no live action or unsupported result is claimed [ ] Responsible reviewer checks the original records before a real deployment RECIPE-SPECIFIC REVIEW IT verifies coverage and recovery tests; test a system absent from all jobs and a green job with no restore drill. Security configuration, purchases, retention changes and restorations remain separate authorized actions. VALIDATION Exact CSV header order, field counts, serialized round-trip values and fixture semantics were checked during kit preparation. This does not test OCR, a vendor integration, a model response or end-to-end reliability. All data and identifiers are synthetic. Dates are fixed fixture dates, not current monitoring results.