A few years ago, getting cyber insurance meant ticking a few boxes on a two-page form. Not anymore. After waves of ransomware claims, insurers have become far more selective – and backups are now one of the first things underwriters check.
Ransomware was involved in 44% of breaches analysed in Verizon’s 2025 Data Breach Investigations Report, and IBM’s 2025 Cost of a Data Breach report put the global average breach cost at $4.44 million. Insurers pay a large part of those bills, so they want proof that you can recover without paying a ransom.
This article explains what insurers typically ask about backups, how to prove your answers, and the mistakes that lead to higher premiums – or denied claims.
Why insurers care so much about backups
From an insurer’s point of view, a ransomware claim has two expensive parts: business interruption (every day your systems are down) and recovery costs (forensics, rebuilding, sometimes a ransom). Reliable backups reduce both dramatically.
That’s why many insurers now treat a few controls as eligibility gates – without them, you either won’t get cover, or you’ll get it with lower limits, higher deductibles and ransomware sublimits:
- Multi-factor authentication on email, remote access and admin accounts
- Endpoint detection and response (EDR) on endpoints and servers
- Immutable or offline backups with documented restore tests
What insurers typically ask about backups
Questionnaires differ between carriers, but these backup questions appear on almost all of them:
Coverage and frequency
- Do you back up all critical systems and data? How often?
- Are cloud and SaaS data (e.g. Microsoft 365) backed up?
- What are your RPO and RTO for critical systems?
Separation and immutability
- Is at least one backup copy offline, air-gapped or immutable?
- Are backups segregated from the production network and production credentials?
- Can a domain administrator delete or encrypt your backups?
Access and security
- Is MFA enforced on backup consoles and backup storage accounts?
- Are backup admin accounts separate from regular admin accounts?
- Are backups encrypted?
Testing
- How often do you test restores? When was the last successful test?
- Do you have a documented disaster recovery / incident response plan? Has it been tested?
At renewal, expect follow-up questions: what percentage of systems is covered, have there been incidents, and what has changed.
The backup controls underwriters expect
Here’s what a strong answer looks like for each area.
1. Immutable or offline copies
At least one copy of critical data must be impossible to alter or delete – even for an attacker with admin rights. Options include:
- S3 Object Lock on AWS, Wasabi, Backblaze B2 or compatible storage
- Hardened Linux repositories with immutability flags
- Tape or rotated removable media stored offline
- WORM storage appliances
See how this works in practice with NAKIVO and Wasabi or NAKIVO and Backblaze.
2. Separation from production credentials
Attackers usually compromise Active Directory first and then go after backups. Your backup infrastructure should:
- not be joined to the production domain
- use separate accounts and passwords
- be reachable only from management networks
3. MFA on backup access
MFA on email and VPN is no longer enough. Insurers increasingly ask specifically about MFA on backup consoles, hypervisor management and cloud storage accounts.
4. Documented restore tests
A backup that has never been restored is an assumption, not a control. A common expectation is quarterly restore tests for critical (tier 1) systems, with results documented: date, system, time taken, success or failure, and lessons learned.
5. Defined RPO and RTO
Insurers want to know how much data you could lose and how long you’d be down. A simple table per system tier is enough – as long as your tests show you can actually meet the targets.
6. Coverage of SaaS and cloud
Microsoft 365, Google Workspace and other SaaS platforms are frequent attack targets. Native retention isn’t a backup. Our Microsoft 365 backup comparison covers the options.
How to prove it: the evidence pack
Insurers increasingly verify answers instead of trusting them. Some scan your external attack surface before quoting; after a claim, forensic investigators will check whether the controls you described actually existed.
Prepare an evidence pack you can update before each renewal:
| Control | Evidence |
|---|---|
| Immutable / offline backups | Screenshots of repository or bucket immutability settings; tape rotation log |
| Backup coverage | Backup job success report (aim for 95%+ coverage, exceptions documented) |
| Separation | Network diagram; list of backup accounts showing no domain membership |
| MFA on backups | List of privileged accounts with MFA status |
| Restore testing | Dated restore test log with results |
| RPO / RTO | Table of systems, tiers and targets |
| DR / IR plan | Current plan, date of last tabletop exercise |
The same evidence helps with audits under NIS2, ISO 27001 and customer security questionnaires – so you only build it once.
The biggest risk: answers that don’t match reality
The insurance questionnaire isn’t a formality. Your answers are attestations, and the policy is written on the assumption that they’re true.
A common reason for disputed or denied claims is a mismatch between what was declared and what forensic investigators find after an incident – for example:
- „MFA everywhere“ – but one legacy VPN or service account had no MFA
- „Immutable backups“ – but immutability was never enabled on the repository, or retention was set to one day
- „Offline copies“ – but the „offline“ NAS was permanently mounted
- „Tested restores“ – but the last test was two years ago
Tip: have the person who actually runs backups review the questionnaire before it’s signed. Answer precisely – „MFA on 95% of admin accounts, remaining two accounts scheduled for migration by March“ is better than an inaccurate „yes“.
What it costs if you don’t
Missing controls rarely mean an outright rejection anymore – instead, they show up in the price and terms:
- Higher premiums and deductibles
- Ransomware sublimits – e.g. a €2M policy that pays only €250k for ransomware
- Exclusions for incidents related to missing controls
- Non-renewal after a claim or failed assessment
Investing in immutable storage and regular restore tests often costs less than one year’s premium increase.
Quick checklist before your next renewal
- All critical systems and SaaS data backed up
- At least one immutable or offline copy
- Backup infrastructure separated from production domain and credentials
- MFA on backup consoles, hypervisor management and cloud storage
- RPO/RTO defined per system tier
- Restore tests at least quarterly for critical systems – documented
- DR / incident response plan updated and tested in a tabletop exercise
- Evidence pack updated
- Questionnaire reviewed by the people who run the systems
FAQ
Do insurers require immutable backups?
Most don’t use a strict legal definition, but immutable or offline backups have become a de facto requirement for ransomware cover. Without them, expect lower limits or ransomware sublimits.
How often should we test backups for cyber insurance?
Quarterly restore tests for critical systems are a common expectation, plus an annual full DR test. Always document the results.
Can a claim be denied because of backups?
Yes – if the backup controls described in the application didn’t exist or weren’t working at the time of the incident, the insurer may dispute or deny the claim.
Is cloud backup enough?
Cloud backup is fine as long as it’s immutable, protected with MFA and separated from production credentials. A sync service like OneDrive is not a backup.
Does cyber insurance replace a good backup strategy?
No. Insurance covers some financial losses; it doesn’t restore your data or your customers‘ trust. Insurers themselves see backups as the primary defence.
Conclusion
Cyber insurers have learned the hard way that backups decide how expensive a ransomware attack becomes. Today they expect immutable or offline copies, separated credentials, MFA and documented restore tests – and they increasingly verify those claims.
The good news is that these are exactly the controls you need anyway. Build them, document them, and your next renewal – and your next incident – will be a lot less painful.
Schreibe einen Kommentar