Have you tested the successful restoration and recovery of key server configurations and data from backups in the last 6 months?
A backup that has never been restored is a hypothesis. Carriers ask for the date because the date is the only part of this that can be checked.
What the carrier is actually asking
The carrier is asking whether you have actually recovered key server configurations and data from backup within a recent window, usually six months, and whether the test covered the systems that matter rather than a convenient sample. The wording asks about servers and configurations deliberately, because restoring a file is easy and rebuilding a system is not.
Why it is underwritten
Backup jobs report success on data they can no longer restore with unsettling regularity: media faults, encryption key loss, application-inconsistent snapshots, missing dependencies. The carrier is buying the recovery, not the copy, and the test is the only evidence that the two are the same thing.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Restore testing happens in your backup product and your infrastructure, so this answer is attested. The evidence that supports it is a record, and it is worth producing in a form an underwriter can read.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Backup product | Restore job history with dates, scope, and outcome | Actual restore operations, not verification jobs or synthetic full builds |
| Test record | A written record naming the system, the date, the recovery point, elapsed time, and who performed it | Enough detail to answer the follow-up question about recovery time with a measurement rather than an estimate |
| Azure | Where recovery lands in cloud infrastructure, the restored resources and their creation timestamps | Evidence that the restore produced a working system rather than a mounted copy |
| Microsoft 365 | A tested recovery of mail or site content, where cloud-to-cloud backup is in place | The software-as-a-service half of the estate is included in testing, not only servers |
| Test record | Findings and remediation from the last test | A test that found nothing is either a very mature estate or a very shallow test |
Restoring a document proves the media reads. Rebuilding a domain controller, a database with its dependencies, or an application with its configuration proves recovery. The second is what the question means and what an incident will require.
What a defensible yes requires
- A restore has been performed within the stated window, with a dated record.
- The test covered a system whose loss would actually stop the business.
- Elapsed time was measured, so the recovery time answer elsewhere on the application is grounded.
- Failures found during the test were remediated and the remediation was verified.
- The immutable or offline copy was included in a test, not only the online copy.
How this answer goes wrong
The most common overstatement is counting verification as testing. Backup products offer automated verification that a backup is readable, and it is valuable and not a restore. The second is scope: the last true restore was a mailbox recovered for a user, which is recorded as a successful restore test and proves nothing about the file server or the database.
Frequently asked
How often should we test?
The question sets six months, and quarterly is a stronger answer. What matters more than frequency is that each test exercises a different critical system so the coverage rotates.
Does an isolated recovery lab count?
Yes, and it is the ideal form, because it tests recovery without touching production. Several backup products can automate it, which turns this answer into a scheduled artefact.
What if a test fails?
That is the test working. Record it, remediate, retest. A record showing a failure found and fixed is more credible to an underwriter than an unbroken run of successes.
How does this connect to the recovery time question?
Directly. The recovery time estimate elsewhere on the application should come from the measured elapsed time in these tests. An estimate with no test behind it is the number carriers discount most.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture