A financial services firm has documented a disaster recovery plan for its core transaction platform but has never validated it beyond reviewing the written procedures. The risk practitioner wants to recommend a test that provides meaningful assurance that recovery procedures actually work while minimizing the risk of disrupting live production operations. Which testing approach should the practitioner recommend as the next step?