Backups and Recovery Requirements

Backups and Recovery Requirements

Photo by panumas nikhomkhai on Pexels

After MFA, backups are the second most scrutinized requirement on cyber insurance applications. Insurers want proof that if ransomware encrypts your primary systems, you can restore from clean backups without paying a ransom. Without adequate backups, you're at the mercy of attackers — and insurers see you as a high-risk client likely to file an expensive ransomware claim.

The 3-2-1 Backup Rule

This is the industry standard insurers expect to see documented:

• 3 copies of your data — the original plus two backups
• 2 different media types — e.g., local disk and cloud storage
• 1 copy stored offsite — disconnected from your network, so ransomware can't reach it

If all three backups are on the same network and ransomware encrypts the network, all backups are compromised too. The offsite, offline copy is what saves you.

What Insurers Ask About Backups

Typical application questions include:

• Do you maintain backups of all critical systems and data? (Yes/No)
• How frequently are backups performed? (Daily is expected; hourly for critical databases)
• Are backups stored offline or offsite? (Must be yes)
• Have you tested restoring from backups in the last 12 months? (Must be yes — they may ask for proof)
• Are backups encrypted? (Expected yes, with documented key management)
• What is your Recovery Time Objective (RTO)? (Target time to restore operations — typically 4–24 hours for small businesses)

Free and Low-Cost Backup Solutions

• Microsoft 365 — OneDrive and SharePoint retain deleted files for 30–93 days (depending on license). But note: Microsoft does not protect against ransomware that runs under your own user account. Consider a third-party M365 backup like Veeam (free for up to 10 users).
• Google Workspace — Google Vault provides retention policies and eDiscovery. Standard Google Drive keeps versions for 30 days.
• Veeam Agent for Windows/Linux — Free standalone edition backs up physical servers and workstations to local or cloud storage.
• BorgBackup / Restic — Open-source backup tools for technically inclined users. Highly efficient, encrypted, deduplicated backups to any SSH target.
• Cloud storage — AWS S3, Backblaze B2 ($0.005/GB/month), or Wasabi ($0.0069/GB/month) for offsite backup storage. A 500GB backup costs about $2.50–$3.50/month on Backblaze.

Step-by-Step: Set Up Veeam Agent Free

1. Download Veeam Agent for Microsoft Windows or Linux from veeam.com (free)
2. Install on the server or workstation you want to protect
3. Configure a backup job: select volumes, set schedule (daily at 2 AM)
4. Set backup target: external USB drive, NAS, or cloud (Backblaze B2)
5. Enable encryption on the backup file with a strong passphrase
6. Run the first backup and verify completion
7. Test restore: select a file, restore it to an alternate location, verify integrity
8. Document the process, schedule, and test results for your insurance application

Testing Your Backups: Critical Step

An untested backup is a wish, not a strategy. Insurers increasingly require proof of a successful restore test within the last 6–12 months. Schedule a quarterly test:

1. Select a representative set of files
2. Restore to an isolated test environment
3. Verify the files open correctly and contain expected data
4. Log the test date, files restored, and results

Key Takeaways

• Follow the 3-2-1 rule: 3 copies, 2 media types, 1 offsite/offline
• Insurers require proof of backup testing within the last 6–12 months
• Free tools (Veeam Agent, BorgBackup) meet insurance requirements when properly configured
• Cloud backup storage costs $2–$4/month for 500GB — far cheaper than a ransom payment
• Document everything: schedule, encryption, test results, RTO

Deep Dive: Practical Implementation Details

Understanding the theory behind cyber insurance readiness is important, but putting it into practice is where most organizations struggle. Let's break down the concrete steps you need to take to move from awareness to action. Many businesses treat cyber insurance as a checkbox exercise — they purchase a policy and assume they're protected. In reality, the policy is only as good as your organization's actual security posture and documentation. Insurers are becoming increasingly stringent, requiring evidence of implemented controls before issuing or renewing policies.

Real-World Scenario

Consider a mid-sized manufacturing company that held a cyber insurance policy for three years without ever reviewing its coverage. When they suffered a ransomware attack that encrypted their production systems, they discovered their policy excluded coverage for acts of war — and the insurer argued the attack was state-sponsored. The company spent over $2 million in recovery costs out of pocket. This situation is increasingly common as insurers refine their exclusions. The lesson: review your policy annually with a qualified broker who understands cyber risk, and document every security control you implement to strengthen your position during claims.

Free and Low-Cost Tools to Support This Step

You don't need an enterprise budget to build cyber insurance readiness. The following free or low-cost tools can help you implement and document the controls discussed in this lesson:

• NIST Cybersecurity Framework (CSF) — A free framework that provides a structured approach to managing cybersecurity risk. Use it as your baseline for organizing your security program. Download the framework and its companion documents from the NIST website at no cost.
• CIS Controls — The Center for Internet Security offers a free set of 18 prioritized security controls. Their free implementation guides walk you through each control with specific, actionable steps.
• CISA Cyber Hygiene — The U.S. Cybersecurity and Infrastructure Security Agency offers free vulnerability scanning for public-facing IPs and domains. This is an excellent way to demonstrate proactive risk management to your insurer.
• SecurityScorecard Free Tier — Provides a free security rating for your organization's external posture, which insurers increasingly use as part of their underwriting process.

What Happens If You Skip This Step

Organizations that neglect this area face several serious consequences. First, you may be unable to obtain cyber insurance at all — many insurers now require evidence of specific controls before offering coverage. Second, if you do obtain coverage but haven't implemented the required controls, your claim may be denied when you need it most. Third, without proper documentation, you'll struggle to demonstrate compliance during the underwriting process, potentially resulting in higher premiums or reduced coverage limits. Finally, in the event of an audit or breach investigation, the absence of documented controls can expose your organization to regulatory fines and legal liability that insurance may not cover.

Common Questions (FAQ)

Q: How often should we review this aspect of our cyber insurance readiness?
A: At minimum, conduct a review annually before your policy renewal. However, any significant change in your IT environment, business operations, or regulatory requirements should trigger an immediate review. Many organizations benefit from quarterly check-ins to ensure their documentation stays current.

Q: What if we don't have dedicated security staff?
A: This is a common challenge for small and mid-sized organizations. Consider engaging a managed security service provider (MSSP) for monitoring and incident response, and use frameworks like NIST CSF or CIS Controls as your roadmap. Many insurance brokers also offer risk assessment services as part of their offering. The key is to document what you do have in place, even if it's basic controls like antivirus, firewalls, and employee training.

Q: Will implementing these steps actually reduce our premiums?
A: While there's no guarantee, insurers increasingly offer premium discounts for organizations that can demonstrate strong security postures. Documented implementation of recognized frameworks like NIST CSF, regular employee training, and tested incident response plans are among the factors that can positively influence underwriting decisions. Some insurers offer discounts of 5-15% for verifiable security controls.

Q: How do we document our controls for the insurer?
A: Create a security documentation binder (digital or physical) that includes: your security policies, risk assessment results, training records, incident response plan, backup and recovery procedures, and evidence of control implementation (screenshots, configuration exports, scan reports). Update this binder regularly and have it ready before renewal discussions.