How to answer the backup and recovery question on a cyber insurance application

Most cyber insurance applications ask about backups in one question or a short cluster of them. The wording moves around, but the questions usually cover three matters: do backups run regularly, is a copy kept offline or immutable, and has a restore been tested?

The question reads like a yes-or-no item, but it is not asking whether backups exist. Almost every business already has something it calls a backup. The insurer is asking something narrower. Would that copy survive a ransomware attack or a destructive intrusion, and would it bring your business back inside a timeframe you can absorb?

A folder that syncs to the cloud every night runs regularly, so it answers the frequency part with a yes. Whether it is separate from the network is a maybe, because the same intrusion that locks the live files can often reach the synced copy too. This guide covers how to establish your real answer, system by system, and what to write on the form.

The three parts the question breaks into

Wording differs by insurer, but the question usually breaks into three parts, and each one checks something different.

Frequency and coverage. Whether backups run automatically on a schedule, and whether they cover everything your business would need in order to keep operating. That is broader than the files staff think to save. It includes email and shared files in Microsoft 365 or Google Workspace, and your accounting and line-of-business systems. A line-of-business application is the software that runs the business's core work, such as practice management or point of sale. Frequency and coverage also include anything held on a server or file store rather than in a cloud service. A backup that covers the shared drive but misses the accounting system is an honest partial yes.

Separation from the network. A copy counts as separate in one of two ways. Offline means held on media that is disconnected from the network rather than continuously reachable. Immutable means stored so that it cannot be altered or deleted for a set period, even by an attacker or an administrator holding valid credentials. This part is often missing, because one administrator login commonly opens the live systems and the backup console alike. Building that separation is a subject of its own, covered in the guide to backups that survive ransomware.

A tested restore. This part is often answered too generously. A completed backup job is not evidence that a restore would work. A restore test means a staff member or the IT provider pulled data back from the backup, confirmed it opens and is complete, and recorded how long that took. That elapsed time is worth writing down. Set a target against that time for each system. A recovery time objective is that target: the number of hours a system can be down before the business suffers. The difference between the two figures shows whether the business's recovery would fall short of what it can absorb, and by how much.

Checking the answer in an afternoon

This question gets answered from memory because the honest answer spans several systems, and no one person in the business has reviewed all of them together. The check is worth doing in one sitting rather than assembling the answer under a deadline.

Start with your email and file platform. What Microsoft 365 and Google Workspace provide by default is a recycle bin, version history, and short deleted-item retention. Those are recovery features with a time limit on them, not backups, and an attacker holding administrator rights can outlast that limit. Microsoft sells a separate backup service for Microsoft 365, which an administrator has to switch on and pay for. Check whether that service meets the immutable definition above before describing it that way on the form. Google Workspace gives an administrator a restore window after a user empties the trash, and, on some editions, Vault adds retention and search on top. Neither default is a backup of all the business's data on the platform, so the question to settle is whether a dedicated backup covers that data.

Next, the file server or network-attached storage (NAS) device that holds the shared drives your staff work from daily. Also check any machine running a single line-of-business application. These systems are often forgotten, because staff rarely think of a storage box or a desk machine as a computer. Then your accounting and line-of-business systems themselves. These are frequently cloud services with their own backup settings that the business has never reviewed.

Finally, if you have an IT provider under contract, ask what your agreement covers. A help desk or break-fix agreement does not automatically include backup management or a restore. A break-fix agreement pays the provider per repair rather than for ongoing management. Learning that during an incident means paying for the restore as chargeable emergency work, quoted under pressure, at the worst moment.

For each system, three questions settle the whole form. Does a backup run automatically? Is at least one copy offline or immutable? Has the business restored from it? Get each answer in writing from the administrator of that system rather than relying on an impression.

What to write when the answer is a partial yes

Many applications include a comment field, and insurers can read them. A qualified answer that names what is covered and what is scheduled next is stronger than a bare no. It is also safer than an answer that overstates the position.

A comment along these lines serves the purpose: "Automatic backups cover the file server and the accounting system. A dedicated backup for the email and file platform was added this quarter, and a restore was last tested on [date]." That tells the insurer you know your own position and are closing gaps in order.

Accuracy matters more than the phrasing, because the business signs the application as a true statement, and an inaccurate answer can put a claim at risk. The wider question of answering honestly when the answer is no is covered in the guide to answering a cyber insurance questionnaire.

Whatever you write, keep the evidence behind it. A dated restore-test note is the most useful record for the form: what was restored, how long it took, and who ran it. That note is what turns a claim about testing into something you can show.

Closing the gap, in order

Turn on automatic backups covering everything that matters. Set a schedule for each system identified above, so coverage does not depend on a staff member remembering (PR.DS-11).

Move at least one copy offline or to immutable storage. Immutable retention is a setting on many business backup services, and a disconnected drive kept off-site is a legitimate alternative where it is not. The ransomware guide above covers choosing between them (PR.DS-11).

Write down who leads recovery and in what order systems come back. A short plan names a recovery lead and a deputy and ranks systems by how urgently your business needs them. Recovery then follows a sequence rather than improvisation (ID.IM-04, RC.RP-01, RC.RP-02).

Run a real restore and record it. Twice a year is a reasonable minimum, and some applications ask whether restores are tested at least quarterly. Confirm the copy is complete and free of anything malicious before trusting it, particularly where the reason for restoring was an infection (PR.DS-11, RC.RP-03).

Check the restored system before calling it normal. Confirm the data is complete against a reference you trust, such as a recent record count or report. Do not stop at confirming that the system switches on (RC.RP-05).

Where this sits in NIST CSF 2.0

These steps map to named outcomes in the NIST Cybersecurity Framework (CSF) 2.0. That is useful when an insurer, a customer, or an advisor asks the same question in different words.

Backups sit in the Protect function, under Data Security, as subcategory PR.DS-11: "Backups of data are created, protected, maintained, and tested."

Recovering from them sits in the Recover function, in the Incident Recovery Plan Execution category, RC.RP. Its stated outcome is that "Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents." That category holds six subcategories, and four of them describe the steps above. RC.RP-01 is that "The recovery portion of the incident response plan is executed once initiated from the incident response process." RC.RP-02 is that "Recovery actions are selected, scoped, prioritized, and performed." RC.RP-03 is that "The integrity of backups and other restoration assets is verified before using them for restoration." RC.RP-05 is that "The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed."

Writing the recovery plan down sits in the Identify function, under Improvement, as subcategory ID.IM-04: "Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved."

Before the form arrives

None of the steps above has to be settled at once. The free ten-minute health check asks ten questions of this kind. One of them is the backup question in its shortest form: does your business keep a backup copy of its data offline, or in storage that cannot be altered? It needs no account, and the answers stay in your browser rather than being sent anywhere.

From there, a self-guided assessment works through backups and the other subjects an insurer asks about. It runs at either the NISTquick or the full scope. The report that unlocks on payment produces a prioritized list rather than a single pass-or-fail verdict. Doing that before the application arrives turns the form into a transcription exercise rather than a discovery exercise under a renewal deadline.

One limit applies. An assessment does not decide whether an insurer offers coverage, or at what premium. The insurer also weighs the industry your business is in, its revenue, its claims history, and the limits you ask for. What an assessment gives you is an accurate account of your own position. That is what the question was asking for, and what you would want to know regardless.

A consultant-led assessment is the natural next step once the largest gaps are closed, not something the self-guided assessment replaces. The small business guide to cybersecurity assessments covers how the two fit together.