What your insurer wants to see about backups before they pay
Your insurer wants dated evidence that the backup answers on your application were true. That means a restore test log with dates, durations and named systems. Those answers are representations the insurer relied on, and the evidence cannot be created after the loss. CISA puts the testing floor at once per year.
- An application answer is a representation the insurer relied on. New York's insurance statute lets a material misrepresentation avoid the contract entirely.
- The artifact that settles a backup answer is a dated restore test log. It names what came back, from which copy, and how many hours it took.
- The federal flood policy, the one insurance contract whose full text is published in law, is void if the insured misrepresented a material fact, and void back to the date of the act.
- Proof of loss runs on a clock. That same federal policy allows 60 days from the loss for a signed and sworn statement of the amount claimed.
- Your logs expire before the breach is found. Sophos saw firewalls defaulting to seven days of retention, while IBM measures 247 days to identify and contain a breach.
What does your insurer want to see about backups?
Your insurer wants dated proof that the backup answers you gave on the application were true when you gave them. In practice that means a restore test log, your retention settings shown on screen, and the name of the person who ran the test.
The questions look like paperwork. A grid of yes and no boxes, ten minutes with the office manager, done before lunch. What you produced was a set of statements the insurer used to decide whether to underwrite you at all, and at what price.
Backups sit at the center of that grid for one reason. Verizon found that 48 percent of all breaches now involve ransomware, and the backup copy is what decides whether that is a rough two weeks or a closed business.
This is not legal or insurance advice, and your own policy wording governs. We also cannot tell you what a particular carrier does, because private policies and application forms are not public. What is public is the legal mechanic, the standard clauses, and the control standards the questions track.
Read it beside When was your backup last restored for the test itself, the Cyber Insurance Coverage Checklist for what a policy covers, and How Much Does Cyber Insurance Cost? for pricing.
An application answer is a representation, not paperwork
An application answer is a representation, which insurance law defines as a statement of fact you make to persuade an insurer to issue a policy. That is a legal category, not a formality.
New York's insurance statute states the rule plainly, and it is one of the clearest public statements of a principle most states share. A representation is a statement of past or present fact made to induce the insurer to enter into the contract, and a misrepresentation is a false representation. Then comes the bar that decides whether a false answer matters. No misrepresentation avoids a contract of insurance unless it is material, and material means the insurer would have refused the contract had it known the true facts.
Read that test twice. The question is not whether you meant to mislead anybody. It is whether an underwriter who knew the real answer would still have written the policy. The statute makes evidence of the insurer's practice in accepting or rejecting similar risks admissible on exactly that point.
A warranty is the stronger version of the same idea
A warranty turns a fact into a coverage condition. The statute defines it as a provision making a fact a condition precedent to the insurer's liability, which means the duty to pay depends on it. A breach is still not automatic. A breach does not defeat recovery unless it materially increases the risk of loss within the coverage of the contract.
The practical difference is timing. A representation describes the world on the day you signed. A coverage condition describes what you keep doing all policy term. The line we test restores quarterly reads either way, which is why a box ticked in March still matters in November.
A yes you cannot evidence is not an administrative error. It is a statement your insurer relied on, and the document that settles it has to already exist.
What a policy actually says about a false answer
To see what a policy says about a false answer, read the one insurance contract whose full text is published in federal law. Private cyber policies are not public, so nobody honest will quote yours back to you. The federal flood policy is different, and its clauses are standard insurance furniture.
The clause that voids the policy is blunt. It is void and has no legal force and effect if at any time, before or after a loss, the insured has concealed or misrepresented any material fact or circumstance, engaged in fraudulent conduct, or made false statements. Then comes the line people miss. Policies are void as of the date the acts described above were committed.
So a false answer does not fail at the claim. It fails at the application, and the contract unwinds back to that day.
Proof of loss runs on a clock
Proof of loss is your own sworn statement of what you are claiming, and it has a deadline. That policy requires the insured to send a proof of loss within 60 days after the loss, signed and sworn to by you. Sixty days is not long enough to assemble a year of restore evidence nobody ever collected.
Subrogation keeps the file open after you are paid. Once the insurer pays, it is subrogated to your right to recover for that loss from any other person. In plain terms it can step into your shoes and pursue whoever it believes caused the damage, and your managed IT provider is on that list. Every document you give the adjuster joins a record both sides later argue from.
Five backup answers that get ticked too fast
Five backup answers get ticked faster than they get checked. Each one has a public control standard behind it and a single artifact that settles it, listed below.
- We test restores at least once a year. CISA sets that floor, telling organizations to test backups and recovery on a recurring basis, no less than once per year. The artifact is a dated restore test log naming the systems, the source copy and the measured hours.
- Our backups are immutable and offsite. CISA says to securely store backups offsite and offline. The artifact is the retention lock setting and its window, shown on screen, not a product name on an invoice.
- One copy is air gapped. NIST defines an air gap as an interface where two systems are not connected physically and any logical connection is not automated, so data moves only by hand. Isolate one copy from every live network path, and the diagram should show it.
- Multi-factor authentication protects the backup console. CISA tells organizations to require MFA using the strongest available method and that all IT accounts leverage MFA. The artifact is an account list with MFA state exported from the admin portal.
- We have a tested incident response plan. CISA says incident response plans should be reviewed and drilled, at a minimum, on an annual basis. The artifact is the exercise record with a date, an attendance list and what failed.
The MFA line is the one incident responders find untrue most often. Sophos reviewed 661 cases and found a lack of MFA in 59 percent of them. Those were not firms that answered no on a form. Many had bought the license, switched it on for most staff, and left the service accounts and the backup console out of scope.
Here is the asymmetry that should decide where you start. An MFA gap closes in an afternoon and you can export the proof the same day. A year of quarterly restore tests cannot be created on demand. Nobody produces a dated log of a test nobody ran, so that single answer is the one where a tick today becomes a permanent hole in the record.
Your evidence expires before the breach is found
Your evidence expires first, because retention defaults are set in days while breaches are discovered in months. Do that arithmetic once and it changes what you ask for.
IBM puts the average time to identify and contain an active breach at 247 days across all industries. Sophos found missing logs due to data retention issues doubled over the previous year, with firewall appliances defaulting to only seven days, and in some cases 24 hours.
Put the two numbers side by side. Seven days of firewall logs against 247 days to discovery means the record of how the attacker got in is usually gone about eight months before anyone looks for it. Your adjuster asks for that record. So does the forensics firm your policy pays for. Neither can accept a reconstruction written from memory.
CISA names this control and deliberately sets no number. Its log goal says only that logs are stored for a duration informed by risk or pertinent regulatory guidelines, in a central system that only authorized users can change. So somebody has to choose the duration, and in most small firms nobody ever has.
The same trap applies to backup retention. A 14-day window is fine for a file deleted on Tuesday and useless against an intruder who sat in your network for a quarter. Ask for the backup retention and log retention figures in days, in writing, and ask who chose each one.
What belongs in the evidence file
To build the evidence file, collect six documents and date every one. Keep it where you can reach it without your provider, because the week you need it may be the week your systems are down.
- Record the restore test. Date, engineer, systems restored, source copy, start and finish times, and what failed.
- Export the account list showing multi-factor authentication state for every user, administrator and service account.
- Capture the retention settings for backups and logs as a screenshot with the date visible.
- Name the recovery time objective for each critical system. NIST defines it as the length of time a system's components can be in the recovery phase before negatively impacting the organization's mission.
- Keep the incident response plan, with the date of the last exercise and who attended.
- File the contract clauses committing your managed IT provider to each item above.
Two rules make the file worth having. Every item carries a date, and every item is verifiable by somebody who did not produce it. A summary your provider wrote about its own performance, with no date and no raw export behind it, is an assertion rather than evidence.
Collect it quarterly rather than at renewal. A folder assembled the week the cyber insurance application is due is a folder of promises, and it shows.
How to answer a question you cannot evidence
To answer a question you cannot evidence, document what is actually true and attach the plan. A disclosed gap is a risk an underwriter can price. An invented answer is a material misrepresentation waiting for an adjuster to find it.
New York's financial regulator built that choice into its own rules, which makes a useful template because it was designed by a party with nothing to sell you. Covered firms file one of two things a year. Either a certification that they materially complied with the requirements, resting on data and documentation sufficient to accurately determine and demonstrate such material compliance, or an acknowledgment that they did not, which must identify all sections of the rule the entity has not materially complied with and give a remediation timeline.
That filing is signed by the highest-ranking executive and the chief information security officer. The supporting records then stay available for examination for a period of five years, and must include the identification of all areas, systems and processes that require or required material improvement.
Three things in that design are worth copying onto your own form. A senior person signs, so somebody owns the answer. An honest no is a permitted answer, with a date attached. And the records that prove either answer are retained for years rather than produced on demand.
An accurate no is worth more than an optimistic yes. A truthful answer with a date is something an underwriter can price. Send your provider four questions this week, keep the replies, and verify each answer against the file.
- Send the date of our last restore test, what it restored, and the measured hours per system.
- Send the retention figure in days for backups and for firewall logs, with a screenshot.
- Send the account export showing which accounts have no multi-factor authentication today.
- Send the date of our last incident response exercise and what it found.
Replies made of dates and numbers mean the controls are operated. Replies made of product names mean somebody is about to attest to a control nobody runs.
What a clean evidence file does not buy you
A clean evidence file does not guarantee a paid claim, and no honest advisor promises that. Coverage turns on the policy wording, the facts of the loss and the law of your state, and a restore test log controls none of those. Read the policy, and ask your broker what your answers commit you to.
What the file buys is narrower and still worth the quarter hour. It removes one argument, the argument about whether what you said was true, from a week with no spare capacity for arguments. IBM puts the global average cost of a data breach at 4.99 million dollars.
Best IT MSP is an independent directory. We rank providers on verified rating and firmographic data, we label paid placement, and we do not sell IT services or insurance, so there is no restore test on offer here. For the test itself read When was your backup last restored, for the copy an attacker cannot delete read Immutable backup, and the one test that actually counts, and for the targets your restore is measured against read RTO and RPO: the two numbers that decide what you pay.
Start with one date. If nobody in your business can name the day your data last came back, the honest answer on the next application is no, and you have a year to change that.
FAQ
Can an insurer refuse a claim because of a wrong answer about backups?
That depends on your policy wording and your state's law, and nobody can tell you what a given carrier would do. The public mechanic is clear though. New York's statute lets a material misrepresentation avoid a contract of insurance, and material means the insurer would have refused the contract had it known the truth.
What backup evidence should I keep for a cyber insurance application?
Keep a dated restore test log, an export of multi-factor authentication state per account, screenshots of backup and log retention settings, a named recovery time objective per critical system, and the date of your last incident response exercise. CISA sets the restore testing floor at no less than once per year.
What is the difference between a representation and a warranty on an insurance application?
A representation is a statement of fact made to induce the insurer to issue the policy, and a false one matters only if it is material. A warranty makes a fact a condition of the insurer's liability, and a breach matters only if it materially increases the risk of loss within the coverage of the contract.
How long do I have to file a proof of loss?
Your own policy sets the deadline, so read it before you need it. The federal flood policy, whose full text is published in regulation, requires a signed and sworn proof of loss within 60 days after the loss. Sixty days is not enough time to build evidence you never collected.
How long should we keep security logs for an insurance claim?
Longer than it takes to discover a breach. IBM measures an average 247 days to identify and contain an active breach, while Sophos found firewall appliances defaulting to only seven days, and in some cases 24 hours. CISA says retention should be informed by risk or pertinent regulatory guidelines.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across North America. Organic ranking is earned on rating and verified data, and paid placement is always labeled. Ask three merit-ranked firms in your city for a dated restore test log and compare what comes back.