My cyber insurance form asks about backups. How do I answer honestly?
Updated October 30, 2026
Answer the backup questions with four facts you can show: what’s backed up, where the copies live, whether an attacker who gets into your accounts could delete them, and when you last tested a restore. Together they answer what the insurer is really asking: if ransomware hit tomorrow, could you get your business back without paying anyone? If you can’t show one of the four, find out before you tick the box.
Steps
- List what you can’t lose: email, shared files, accounting, customer records, and the data behind your business software.
- Write down where each one’s backup lives. If the answer is “OneDrive” or “the cloud,” note that it’s sync, not a separate backup.
- Ask whoever runs the backups three questions: is any copy separate from our everyday accounts, is it locked against deletion and for how long, and who can delete it?
- Check the backup logins. If they’re the same admin account as everything else, an attacker with that account can reach the backups. Ask whether they require MFA.
- Find the last restore test, and if there isn’t one, run one. How do I know if my business backups actually work? walks you through it.
- Save the evidence: a screenshot of the backup settings and a dated note of the restore test.
Details
Why insurers care about backups
Insurers ask detailed backup questions because good backups are often the difference between a bad week and a business-ending one after ransomware. Attackers know that too. CISA, the U.S. government’s cybersecurity agency, warns that many ransomware variants try to find and delete or encrypt any backups they can reach, and recommends keeping backups offline and encrypted and testing them regularly (CISA #StopRansomware Guide). Backups are one section of the form; What does my cyber insurance application want me to have? covers the rest.
What the questions usually mean
Each backup question is a version of “is there a copy an attacker can’t reach?” Wording varies by insurer, but these are typical:
- Do you keep offline backups disconnected from your network, or use a cloud backup provider? Is there a copy that isn’t on the same network as everything else?
- How are your backup copies stored? Choices often include offline or “air-gapped” backups, backups with no network separation, cloud sync such as OneDrive or Google Drive, and a dedicated cloud backup service. Cloud sync is often its own option, separate from a backup service. If OneDrive is all you have, pick that one. Does OneDrive back up my files? explains why.
- Are all your critical backups immutable? Immutable means locked: once a backup is written, nobody can change or delete it for a set time, not even an administrator. Some forms offer “Unknown,” and that’s honest if it’s true.
Forms also often ask how often you back up, whether backup logins are separate or need MFA, and when a restore was last tested. This isn’t insurance or legal advice, so ask your broker how your answers affect coverage.
“Unknown” and “partly” are real answers
An accurate partial answer beats a hopeful “yes.” Note what’s covered, what isn’t, and when you’ll close the gap, then ask your broker how the insurer treats it. Closing the gaps usually means three things, in this order: a dedicated backup service for your cloud accounts, separate logins with MFA for it, and a scheduled restore test.
New IT PLZ HELP clients get a backup of their Microsoft 365 email, OneDrive, SharePoint, and Teams, kept outside Microsoft 365 so a problem in your account doesn’t take the backup with it (we use Barracuda Cloud-to-Cloud Backup). Ask us anytime what’s covered.
Where doing it yourself gets risky
- Saying “yes” because something is “in the cloud.” Sync isn’t a separate backup, and some forms ask about the difference directly.
- Saying “immutable” when nobody’s sure. If you can’t confirm the backups are locked against deletion, “Unknown” or “No” is the honest answer.
- “All critical backups” when only some are covered, such as email but not the accounting database.
- Backups a vendor “probably” does. Many software providers keep the service running without promising to restore your data. Ask them.
Signs it’s time for help
Get help if any of these is true. You can check the rest yourself.
- You can’t show the date and result of your last restore test, and your renewal is close.
- Nobody can say whether your backups are locked against deletion, or who can delete them.
- OneDrive or another sync tool is the only copy of your files.
Before you answer the backup section, run one restore test: restore a real folder to a new location, open the files, and write down the date and result. Then answer each question with what you actually found. If you’d like help working through the form, we can go through it together.
Book a free 20-minute fit check