The two-week test

This is not a test of your team. It is a test of the system around them.

If two weeks away would be painful, the pain is almost always in four specific places, and none of them take a year to fix.

• Access. Somebody other than you can do the thing, not just ask you to.
• Decisions. They know what they are allowed to decide, and up to what limit, without calling.
• Visibility. Something tells a human that something is wrong. Your attention is not a monitoring system.
• Recovery. There is a named answer to who handles the bad night, and it is not your phone on a beach.

• At least two people can approve a payment, and the second one has actually done it.
• Two people can reach every critical system. One admin is a vacation you cannot take.
• Shared credentials live in a vault the covering person can reach, not in your head or your phone.
• Someone other than you can reset a password or unlock an account.

• A spending limit is written down: under this, decide; over it, wait or call.
• The three decisions you always make are either delegated by name or explicitly parked until you return.
• Clients know who to contact, and that person knows they are it.

• Backups are monitored and someone other than you sees the alert.
• Security alerts go somewhere a human reads, not to an unread mailbox. A partner NOC or SOC counts; an inbox nobody opens does not.
• You would find out about a problem from your team, not from a client.

• There is a written incident plan with phone numbers, and the covering person knows where it is.
• Your IT provider or internal lead has authority to act without you, in writing, up to a defined limit.
• The cyber insurance details, including the notification hotline, are somewhere the covering person can find them.
• Someone knows how to reach you if it truly matters, and everyone knows what truly matters means.

Before the real two weeks, take a deliberate long weekend and route nothing through yourself. Tell the team it is a drill; a surprise test measures how well people cope with surprises, which is not the thing you are trying to learn. Whatever came to you anyway is your gap list, and it is better than any assessment, including this one, because it is made of things that actually happened.

• 12 to 14 checked: go. Take the phone, do not look at it.
• 8 to 11: you can go, and something will come to you anyway. Fix the access gaps first; they are the fastest.
• Under 8: the business is running on your attention. That is not a character flaw, it is a design that worked until it did not scale. Two or three fixes move this a long way.