Backup and restore testing checklist

Backups decide how a ransomware attack ends. With clean, tested backups, you restore and carry on. Without them, you face long downtime and hard choices. Underwriters know this, so backup questions sit near the top of most forms.

They ask two things. Can an attacker reach your backups, and have you proved you can restore? A backup job that shows green every night answers neither. For the wider picture, read ransomware and cyber insurance.

Keep backups out of an attacker's reach

• Keep one copy offline or in a backup cloud serviceRansomware on your network should be unable to touch it. An architecture diagram or a written description from your provider shows the separation.
• Make backups immutable for a set retention periodNobody can change or delete an immutable backup until the lock expires. A console screenshot of the retention lock is clear evidence.
• Use separate admin accounts for the backup systemIf an attacker takes your domain admin account, the backups should stay safe. Show that backup admins sit outside your normal domain.
• Protect the backup console with MFAAttackers look for the backup console early so they can delete restore points. A settings screenshot proves the second factor.
• Follow the 3-2-1 ruleKeep three copies of your data, on two types of storage, with one copy off site. Many underwriters recognise this pattern straight away.

Back up what the business needs to run

• List the systems and data the business depends onInclude servers, cloud apps, databases and key configuration. A short asset list makes sure nothing important is missed.
• Back up cloud services such as Microsoft 365 or Google WorkspaceMany businesses assume the provider keeps a backup for them. Check the service terms, and add a separate backup if you need one.
• Set and write down how often each backup runsDaily may suit shared files, while a busy order database may need backups every hour. Keep the schedule with your evidence.
• Write down recovery time and recovery point targetsThe recovery time target says how fast a system must be back. The recovery point target says how much data you can afford to lose.
• Check how far back you can restoreAttackers often stay hidden in a network for some time before they strike. Keep backups long enough to reach a clean copy.

Prove you can restore

• Restore key servers and data in a testPick a real system, restore it to a safe place, and check it works. Underwriters often ask whether you did this in the last six months.
• Record the date, scope and time takenA short, dated test record is the evidence underwriters accept. Note anything that failed and how you fixed it.
• Time a full restore of your most important systemCompare the result with your recovery time target. If the restore takes longer, put the gap in your improvement plan.
• Test a restore from the offline or immutable copyThis is the copy you will rely on after ransomware. Prove it works on its own.
• Repeat restore tests at least every six monthsSystems change, and an old test proves less over time. A six month cycle matches what many forms ask for.

Link backups to business continuity

• Plan how to keep working while systems are downManual workarounds, other suppliers and extra staff all count. Many business interruption claims look at the steps you took to reduce the loss.
• Know where your finance records live during an outageInsurers often ask for invoices, sales figures, payroll and accounts to calculate lost income. Make sure you can reach them when your main systems are locked.
• Keep the recovery runbook outside your networkA printed copy, or one in a separate account, still works when your network is down.

Broker's tip

When I review a backup answer, I ask for the last restore test before anything else. A dated record with a timed restore makes the conversation with an underwriter much easier, and it helps again with a claims team after an attack. A green dashboard is a good start. Pick one important system this month, restore it, write down what happened, and file the record with your insurance evidence.