What to Ask Your IT Provider About Backup and Recovery
By Dane Gray, 24uNet
Ask your IT provider three things: when they last restored real files from your backups, how much recent work you could lose (your RPO), and how long you could be down (your RTO). If they can't answer with dates and test results, your backups are a hope, not a plan.
Most small businesses have been told "yes, you're backed up." Far fewer have seen proof that a restore actually works. This guide gives you the questions to take to your current IT provider, explains the two terms that matter most, and shows what a good answer looks like. You don't need to be technical to use it.
Why isn't "we have backups" enough?
A backup is only useful if you can get your data back, in a usable state, fast enough to keep the business running. Backups fail quietly. A job stops running after a password change. A new shared folder never gets added. Cloud email and files are assumed to be covered when they aren't. Ransomware reaches the backup copies because they sit on the same network with the same logins.
None of these show up until the day you need a restore. That's why the most important question isn't "do we have backups?" It's "when did we last prove we can restore?"
What are RPO and RTO, in plain English?
These two terms decide what a good backup plan looks like for your business. Your IT provider should be able to explain both without jargon.
Recovery point objective (RPO) is how much recent work you can afford to lose. If your last good copy is from last night, anything created today is gone and has to be redone. Ask yourself: how much re-work could the team absorb before it hurts clients or deadlines?
Recovery time objective (RTO) is how long a system can be down before the damage is serious. Email might tolerate a short outage. Your accounting system at month-end, or a project file server the day before a deadline, might not.
There's no single right answer. The right RPO and RTO come from your business, not from your IT provider's default settings. A good provider asks you about them system by system and then designs backups to match. If nobody has ever asked you these questions, that's the first gap to close. Our business continuity planning page walks through how to set them.
What should I ask about restore testing?
Restore testing is where backup plans prove themselves. Take these questions to your provider:
When was the last time you restored real files or a full system from our backups, and what happened?
Do you test restores on a schedule, or only when something breaks?
Can you show me a written record of the last test, with the date, what was restored, and whether it worked?
Have you ever tested restoring a whole server or computer, not just a single file?
If we lost our main server today, what are the actual steps, and who does each one?
A strong answer includes a date, a specific system, a result, and anything that went wrong and was fixed. A weak answer sounds like "the backups show green" or "we'd figure it out."
Which questions cover what is actually backed up?
Gaps in coverage are one of the most common problems we find. Ask:
Which systems, folders and devices are included, and which are left out on purpose?
Are Microsoft 365 email, OneDrive, SharePoint and Teams data backed up separately, or are we relying on default retention?
Are laptops and remote staff included, or only the office?
When we add a new shared folder, application or employee, who makes sure it gets added to the backup?
Do we get an alert when a backup job fails, and who reads it?
Ask for a one-page list of what's covered. If it doesn't exist, ask for it to be written.
How do I know my backups would survive ransomware?
Attackers often look for backups first, because deleting them makes the ransom more likely to be paid. Ask:
Is at least one copy of our backups kept off our network, or in a form that can't be changed or deleted for a set period?
Do the backup system's logins use different credentials and multi-factor authentication?
If an attacker took over an admin account, could they delete our backups?
How would you know the copy you're restoring from is clean?
These questions connect directly to the controls in our Security Baseline. If you want a quick self-check, the Security Baseline Checklist covers backups alongside identity, devices and email.
What if the whole office is unavailable?
Restoring files is one thing. Running the business when the building, the server room or the internet connection is out is another. Ask:
If our office were unusable for a while, where would we work from, and what would we use?
Which systems do we have a standby for, and which would we rebuild from scratch?
Is our recovery plan written down somewhere we can reach without our own systems?
Your provider should be able to explain whether your setup is closer to a hot, warm or cold site, and why. Our guide to hot, warm and cold sites for small businesses explains the trade-offs in plain terms.
The take-this-to-your-IT-provider checklist
Print this list or paste it into an email to your provider:
When did you last test a restore from our backups, and can I see the record?
What RPO and RTO have you designed our backups around, system by system?
Did you ask us what we need, or are these default settings?
What exactly is backed up, and what is left out?
Is our Microsoft 365 data backed up separately?
Is at least one copy offline or protected from deletion?
Could a stolen admin account delete our backups?
Who gets backup failure alerts, and what happens next?
Where is our written recovery plan, and when was it last reviewed?
If the office were unavailable, how would we keep working?
What does a good answer look like?
You're looking for specifics: dates, written records, named systems and a clear owner for each step. A good provider welcomes these questions. If the answers are vague, or the questions make your provider uncomfortable, it may be time for a second opinion.
24uNet works with small businesses in Colorado and Texas, including teams around Denver and Bryan–College Station. We design backups around your real recovery needs, test restores, and document the results. Our Cybersecurity Business Bundle includes backup and recovery alongside the rest of your security baseline.
Frequently asked questions
How often should backups be restore-tested?
Often enough that a failure would be caught well before you need the backup. Many businesses test on a regular schedule and after any major change, such as a new server or application. The key is a written record of each test.
What is the difference between RPO and RTO?
RPO is how much recent work you can afford to lose. RTO is how long a system can be down before the damage is serious. Together they set how often backups run and how fast recovery has to be.
Is Microsoft 365 data backed up automatically?
Microsoft 365 keeps deleted items for limited periods, but that isn't the same as a separate backup you control. Ask your provider whether your email, OneDrive, SharePoint and Teams data is backed up independently.
What should I do if my IT provider can't answer these questions?
Ask for the answers in writing by a set date. If they still can't provide restore test records or a list of what's covered, get an independent review of your backups.
Can ransomware encrypt my backups?
It can if backups are reachable from your network with the same logins. Keeping at least one copy offline or protected from deletion, with separate credentials and multi-factor authentication, greatly reduces that risk.
Get a second opinion on your backups
Want an independent look at your backup and recovery setup? Call 24uNet in Denver at (303) 468-5515 or College Station at (979) 256-5100, or email sales@24unet.com. You can also reach us through our contact page.
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. CMMC-AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments