Updated
Cyber insurance applications ask the same backup questions in different words: how often you back up, whether a copy is offsite and offline or immutable, whether backup systems are segmented and behind MFA and separate credentials, whether backups are encrypted, and when you last tested a restore. Here is what to set up and what to keep as evidence.
Requirements vary by carrier and policy. Not legal or insurance advice.
Ten requirements cover the backup questions on the applications we reviewed. Not every carrier asks all ten, so check your own form.
| Requirement | What insurers typically ask | How to meet it | Evidence to keep |
|---|---|---|---|
| 1. Frequency | Which systems are backed up, and how often | Daily or better for critical systems; list SaaS data | Schedule and recent job history |
| 2. Offsite copy | Copies in two or more geographic locations | One copy outside your building and network | Provider, location, contract |
| 3. Offline or air-gapped | A copy offline, air-gapped, or in a purpose-built cloud service | A copy your network credentials cannot reach or delete | How it is isolated; media rotation log |
| 4. Immutable | Immutable or write-once read-many (WORM) backups | Object lock, append-only storage or locked snapshots | Setting screenshot; lock period in days |
| 5. Segmentation | Backup servers segmented and off the Windows domain | Own subnet, tight firewall rules, outside Active Directory | Network diagram, firewall rules |
| 6. Separate credentials | Unique backup accounts, stored apart from domain accounts | Dedicated accounts; delete key off production machines | Account and key inventory |
| 7. MFA on backups | MFA on the backup console and on backup files | MFA on every account that can delete or change retention | Dated MFA status screenshots |
| 8. Encryption | Whether backups are encrypted | Encrypt before upload; keep an offline key copy | Encryption setting; key custody record |
| 9. Restore testing | Last tested restore, test frequency, recovery time objective | Scheduled, timed restore tests | Dated restore log with duration |
| 10. Retention | Asked less often; guidance wants time-based retention | History that predates a slow intrusion | Retention policy; oldest restorable date |
Insurers ask which systems you back up and how often, and daily backups of critical systems are the usual baseline.
What insurers ask. Corvus's Smart Cyber Insurance application (version 3.2, September 2024) asks how often you back up, from continuous to monthly. Its ransomware supplement asks whether servers, workstations and SaaS applications are included. Beazley's follow-up questions ask how often critical information is backed up and copied offsite.
How to meet it. Back up critical servers and databases at least daily, and name SaaS data such as email and shared drives in your plan. A file-sync service is not a backup.
Evidence to keep. The schedule as configured and job history showing recent successful runs. If a system is excluded, say so rather than ticking "all servers".
Insurers expect at least one backup copy stored away from your main site and network.
What insurers ask. Corvus asks whether copies are stored in two or more geographic locations. Beazley's Breach Response application asks where backups are stored, with secure offsite storage and a secondary data center among the answers. Coalition's incident response team calls onsite backup software the least effective option, because attackers know how to corrupt or delete it.
How to meet it. Follow the 3-2-1 pattern: three copies, two kinds of storage, one offsite. Offsite should mean a separate building, network and login, not a second server in the same rack.
Evidence to keep. The provider, the city or region of the copy, the contract or invoice, and the date the offsite copy last updated.
Every carrier whose forms we reviewed asks, in some form, whether a copy of your backups is offline or air-gapped.
What insurers ask. Corvus asks whether a copy is kept offline or air-gapped. Chubb's 2026 proposal form describes it as "completely offline or air-gapped (tape or nonmounted disk) that is disconnected from the rest of your network." Beazley asks whether backups are kept separate from your network, or in a cloud service designed for this purpose. CISA advises offline, encrypted backups of critical data.
How to meet it. Read your form's exact words: Chubb's points at disconnected media, Beazley's also accepts a purpose-built cloud service. If unsure, ask your broker.
Evidence to keep. How the copy is isolated: a media rotation log, or proof your network credentials cannot delete a cloud copy.
An immutable backup cannot be changed or deleted for a set period, even by an administrator account.
What insurers ask. Corvus asks whether your backup solution has immutable backups; Chubb asks about immutable or write-once read-many protections. The UK NCSC's principles for ransomware-resistant cloud backups (November 2024) ask providers to block changes once a backup is created and to delay deletion requests. CISA cautions that immutable storage does not meet the compliance criteria of certain regulations.
How to meet it. Use object lock or WORM storage, an append-only backup server, or provider snapshots that sit below your backup software where your keys cannot reach them.
Evidence to keep. A screenshot of the setting and the lock period in days. "Immutable" with no stated period is a weak answer.
Insurers ask whether an attacker who takes over your main network can also reach your backup servers.
What insurers ask. Both Corvus forms list "backup servers are segmented from the rest of the network" and "backup servers are not joined to a Windows domain" as separate options. Beazley's follow-up includes segmentation among backup protections, and Chubb asks whether backup access runs through privileged accounts outside Active Directory.
How to meet it. Put backup servers on their own subnet or VLAN, allow only the traffic backups need, keep them out of the domain, and never expose management interfaces to the internet. An offsite provider is separate by default.
Evidence to keep. A dated network diagram, the relevant firewall rules, and the domain status of each backup host.
The question underneath is whether credentials stolen from your domain can delete your backups.
What insurers ask. Corvus asks whether backup servers and user accounts use unique credentials. Chubb asks for separate privileged accounts outside Active Directory, and Beazley's follow-up asks for unique backup credentials stored separately from other user credentials. NCSC goes further: destructive requests from customer accounts should be refused unless authorised out of band.
How to meet it. Give backup administration its own accounts and passwords, and keep the key that can delete or prune backups off the machines being backed up. Ransomware running with a server's own backup credential should only be able to add data.
Evidence to keep. An inventory of backup accounts and keys, where each is stored, and who can use it.
Insurers ask for multi-factor authentication on the backup console and on access to backup files.
What insurers ask. Corvus's ransomware supplement lists both: MFA for the backup management interface, and MFA for backup files, on premises and in the cloud. Chubb asks whether access to backups is restricted by MFA, and Beazley's follow-up lists it. MFA answers carry weight: in Travelers v. International Control Services (2022), the insurer alleged the application overstated MFA use, and the policyholder agreed to a judgment rescinding the policy.
How to meet it. Turn on MFA for every account that can log in to a backup portal, change retention or delete data. Remove accounts that no longer need access.
Evidence to keep. A dated screenshot of MFA status for each backup admin account, refreshed before every renewal.
Insurers ask whether backups are encrypted, so a stolen backup cannot be read.
What insurers ask. Beazley's ransomware supplement asks directly whether your backups are encrypted. The Marsh McLennan Agency and Arete list of 12 controls recommended by cyber insurers says organizations must encrypt backups and ideally store them air-gapped. CISA's guide pairs offline with encrypted. Corvus asks about encryption of data in general rather than of backups.
How to meet it. Encrypt on the source machine before data leaves it, with a cipher such as AES-256, and use TLS in transit. NCSC recommends an out-of-band copy of the key, such as a printout, because a lost key makes every backup unrecoverable.
Evidence to keep. The setting that shows encryption is on, and a record of where the key and its offline copy are kept.
Insurers ask when you last restored from backup, not only whether backups run.
What insurers ask. Beazley's ransomware supplement asks whether you tested restoring key servers and data in the last six months, and whether you can check backups are free of malware before restoring. Its follow-up asks how often full recovery is tested and for your recovery time objective. Corvus asks how often you test backup integrity, from monthly to untested. Coalition's incident response team recommends testing every three months.
How to meet it. Schedule restore tests, time them, and compare against your recovery objective. Our recovery drill shows a recorded test.
Evidence to keep. A dated log: what was restored, from which snapshot, how long it took, and the result.
Fewer applications ask about retention directly, but it decides whether you can restore from before an attack began.
What insurers ask. Beazley asks how data is backed up and how quickly it can be restored; most forms stop there. The NCSC principles fill the gap: keep backups for a fixed time period rather than a fixed number of copies, keep a version history so an earlier version survives if later ones are corrupted, and alert on retention changes, mass deletions and backups that stop.
How to meet it. Use time-based retention long enough to reach back past an intrusion that went unnoticed for weeks, and make sure a compromised account cannot shorten it. Our retention guide and calculator help size it.
Evidence to keep. A written retention policy and the oldest restorable date.
Work through this before you fill in the backup section, and file the evidence with your signed application.
Backup section · evidence pack · date: ____________
Application answers are statements you sign. If a control is only partly in place, describe it accurately or ask your broker how to answer.
ServerCrate is an offsite, zero-knowledge backup vault for restic. We cover the storage-side items; your schedule, network and restore tests stay with you.
| Requirement | What we provide | What stays with you |
|---|---|---|
| Offsite | Vaults in Los Angeles, on infrastructure and credentials separate from your systems | What to back up, and how often |
| Immutable | Every vault is append-only by default: the backup key can add data, not delete it. Daily storage-level ZFS snapshots, kept 14 days, sit below the backup server where no customer key, prune or ransomware can remove them | Checking your form's offline wording |
| Separate credentials | Pruning needs a separate cleanup key, kept off the backed-up machines | Storing that key safely |
| Encryption | Client-side restic encryption, AES-256; we never receive your key | Keeping the key and an offline copy |
| MFA | Two-factor authentication available on every account | Turning it on |
| Restore testing | The monthly report records the latest restore we observed | Running the restore |
The Backup Evidence Report. Paid plans get a monthly Backup Evidence Report: an ed25519-signed page, PDF and JSON at an unguessable link. It checks offsite storage, append-only mode, the 14-day snapshot lock, encryption, storage integrity by SHA-256 content hashes, backup recency, MFA status and whether a restore test was observed. It states ServerCrate-side facts only, is not a compliance certification, and we make no claim that any insurer accepts it. The free 10 GB tier does not include it.
It varies by carrier and policy, but applications ask about the same controls: frequency, an offsite and offline or immutable copy, segmented backup servers with separate credentials, MFA, encryption, and restore testing.
It depends on your form. Beazley's supplement accepts a cloud service designed for backups; Chubb's describes offline as tape or non-mounted disk disconnected from your network. If the wording is unclear, ask your broker.
A backup that cannot be changed or deleted for a set period, even by an administrator: object lock, WORM storage, append-only servers, or provider snapshots your credentials cannot remove. Know the lock period.
Forms ask rather than prescribe. Beazley asks about a tested restore in the last six months; Corvus asks how often. Coalition's incident response team recommends every three months. Keep a dated log.
Coverage can be at risk. In Travelers v. International Control Services (2022), the insurer alleged the application overstated MFA use, and the policyholder agreed to a judgment rescinding the policy. Answer what is true on the date you sign.
Many forms ask. Corvus asks about MFA on the backup console and on backup files; Chubb and Beazley list it among backup protections. Turn it on for every account that can delete backups.
Not legal or insurance advice. Requirements vary by carrier and policy. Forms are paraphrased except where quoted. Updated October 2026.