---
title: Backup and recovery questions on cyber insurance applications
url: "https://insuranceposture.com/questions/backup-and-recovery"
section: Backup and recovery
questions: 12
updated: 2026-08-24
---

# Backup and recovery: what cyber insurance applications ask

Immutability, separate credentials, encryption, restore testing, and recovery time. This block drives ransomware pricing more than any other technical section.

## 12 questions in this section

- [Are there procedures and tools to back up sensitive data and critical systems?](https://insuranceposture.com/questions/backup-and-recovery/procedures-tools-back-up-sensitive-data-critical-systems) (attested, not tenant-verifiable)
- [Are backups kept offline (disconnected) or immutable / air-gapped?](https://insuranceposture.com/questions/backup-and-recovery/backups-kept-offline-immutable-air-gapped) (partly verifiable from your tenant)
- [Are backups encrypted?](https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted) (partly verifiable from your tenant)
- [Are backups protected by MFA?](https://insuranceposture.com/questions/backup-and-recovery/backups-protected-by-mfa) (partly verifiable from your tenant)
- [Are backups secured with different access credentials from administrator credentials?](https://insuranceposture.com/questions/backup-and-recovery/backups-secured-different-access-credentials-from-administrator-credentials) (partly verifiable from your tenant)
- [Have you tested the successful restoration and recovery of key server configurations and data from backups in the last 6 months?](https://insuranceposture.com/questions/backup-and-recovery/you-tested-successful-restoration-recovery-key-server-configurations-data) (attested, not tenant-verifiable)
- [Are backups tested for malware-free integrity prior to restoration?](https://insuranceposture.com/questions/backup-and-recovery/backups-tested-malware-free-integrity-prior-restoration) (attested, not tenant-verifiable)
- [Estimated time to restore essential functions in widespread ransomware attack?](https://insuranceposture.com/questions/backup-and-recovery/estimated-time-restore-essential-functions-widespread-ransomware-attack) (attested, not tenant-verifiable)
- [How frequently is critical data backed up?](https://insuranceposture.com/questions/backup-and-recovery/frequently-critical-data-backed-up) (partly verifiable from your tenant)
- [Where are backups stored (on-prem / offsite / offline / MSSP / cloud)?](https://insuranceposture.com/questions/backup-and-recovery/where-backups-stored) (partly verifiable from your tenant)
- [If backups are encrypted, are encryption keys stored offline?](https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted-encryption-keys-stored-offline) (partly verifiable from your tenant)
- [Can workstations be reimaged in bulk from a controlled operating system image?](https://insuranceposture.com/questions/backup-and-recovery/can-workstations-reimaged-bulk-from-controlled-operating-system-image) (partly verifiable from your tenant)

Full index: https://insuranceposture.com/questions

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.