Backup and business continuity questions in a security questionnaire
These six questions ask whether you can recover: backups and their frequency, restore tests, a continuity plan, recovery targets (RTO and RPO), key person risk and redundancy.
What the client wants to know
The client wants to know that a failed system, a lost laptop or a sick founder does not end their project. A backup that was never restored is a weak answer, so a tested restore is the detail they look for. Recovery targets show that you have thought about how long an outage lasts and how much work could be lost.
The 6 questions as clients phrase them
The kit covers 6 questions in this area. The wording varies between questionnaires, the control behind it does not.
- Do you back up data, and how often?
- Are backups tested?
- Do you have a business continuity or disaster recovery plan?
- What are your recovery time (RTO) and recovery point (RPO) objectives?
- What happens if a key person becomes unavailable?
- Do you have redundancy for critical systems?
What a good answer contains
- Backups: automatic, at least daily, kept in a separate account or region.
- Restore test: one restore from backup in the last 12 months, repeated at least once a year, with the result written down.
- Continuity plan: covers loss of a system, loss of a laptop, loss of a key person and provider outages.
- RTO and RPO: state targets you can meet. Daily backups mean a recovery point of up to 24 hours.
- Key person: documented access to critical accounts, held in the password manager with emergency access for a second named person.
- Redundancy: say which provider infrastructure you rely on and that you also keep your own backups.
Watch out for
If you have not tested a restore, say it is planned. Then do it: restore one backup into a test environment, time it and write down the result.
Controls behind these answers
These are the controls the free Security Overview builder asks about for this area. Each line is the statement you can make once the control is in place, followed by the fix step if it is not.
- Resilience: Client data and systems are backed up automatically. If not yet: Set up automatic daily backups for databases and file stores, kept in a separate account or region.
- Resilience: A restore from backup was tested in the last 12 months. If not yet: Restore one backup to a test environment, time it, and write down the result. Repeat once a year.
- Access: All staff use a password manager. Passwords are not shared in chat or documents. If not yet: Roll out a password manager for everyone and move shared logins into shared vaults.
Example: how a prepared answer opens
Question: What are your recovery time (RTO) and recovery point (RPO) objectives?
Target RPO is 24 hours (daily backups).
This is the first sentence only. In the kit the full answer is built from your profile, with an honest variant for each control you do not have yet.
Guidance and templates, not legal advice. The kit does not certify you. Your answers must match what you actually do.