Australian cloud for business software — built and run in Sydney since 2003

+61 2 8282 5656
support@netleverage.com
Talk to an engineer
Talk to an engineer
NetLeverage
NetLeverage

Questions to ask a managed backup provider before you sign

Technical article
Backup & Recovery

Originally published:

About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.

A managed backup service is attractive for a business without its own IT staff: someone else runs the jobs, watches for failures and restores when needed. It also means trusting that provider with copies of everything and, usually, with administrator access to your systems.

This guide is for owners and managers comparing managed backup services. It is not about which features a product has. It sets out questions that reveal how a provider would actually behave in a bad week, drawn from Australian Signals Directorate (ASD) guidance on managed service providers and outsourcing, and what a useful answer looks like.

Why it matters

ASD has warned for years that service providers are a route into their customers. Its guide on engaging managed service providers records: "In 2018, malicious actors continued to target and compromise MSPs and, through them, their customers." It adds that "the cost of remediation after a compromise far exceeds the cost of upfront implementation."

A backup provider is a special case, in our reading. It holds the copies you would use to recover from an attack, so if the provider's access is abused, both your systems and your way back can be affected at once.

ASD's guidance is written for organisations generally and its Information Security Manual (ISM) mainly for government; private businesses can use both as a reference (our understanding). ASD itself notes that "The number and type of controls used with an MSP will vary depending on the sensitivity of your systems."

Start with ASD's five questions

ASD publishes a short list, "Questions to Ask Managed Service Providers". Its headings are:

  • "Are you implementing better practice cyber security?"
  • "Are you securely administering your systems and services?"
  • "Are you monitoring activity on your systems and services?"
  • "Are you regularly assessing your systems and services?"
  • "Are you prepared for, and able to respond to, cyber security incidents?"

For the first, ASD points to the Essential Eight: providers "can demonstrate they are implementing better practice cyber security to protect themselves and their customers by implementing the Essential Eight." For administration, it notes that "managed service providers often have privileged access to systems".

These apply to any provider. The sections below add backup-specific questions (our recommendation), grouped by what they reveal.

Who restores, and how fast

  1. Who performs a restore, and how is it requested? Name the team, hours and channel. A restore that needs a ticket answered by one person on business days is a different service from one available at any hour.
  2. What restore time and acceptable data loss do you commit to, and for which systems? Define the contractual clock start/end, usable-state checks, dependencies and acceptable recovery point, rather than relying on a typical figure.
  3. Is that time for a single file, a whole server, or everything at once? After ransomware, many systems may need restoring together (our reading).
  4. Where does the data come from during a restore? If copies sit in a distant region or a slow storage tier, retrieval time adds to every restore.
  5. What restore testing is included, and will we see the results? ASD's Essential Eight expects that "Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises."

A good answer gives named people, contract figures and dated test reports (our recommendation).

Who can delete the copies

  1. Can any of your staff delete or shorten retention of our backups? At its highest maturity level, the Essential Eight expects that "Backup administrator accounts are prevented from modifying and deleting backups during their retention period."
  2. Is the backup system separated from our everyday systems and yours? The ISM includes ISM-2152: "Backup infrastructure, including backup servers, repositories and management consoles, is segregated from production environments and uses a separate authentication mechanism for administrative access."
  3. Are copies locked against change for their retention period? ISM-2151 calls for "a technically enforced immutability mechanism that prevents their modification or deletion for the duration of their retention period."
  4. How do your staff sign in to our systems? ASD advises customers to "Provide the MSP with the least privileged account(s) required to do their job" and to "Enable multi-factor authentication on remotely accessible services used by your MSP to access your network and systems."
  5. Are your staff accounts named and attributable? ASD recommends that "Accounts should be attributable to the MSP to enable easy identification of MSP activity in privilege allocation and logs."

What you will be told, and when

  1. How quickly will you tell us about an incident affecting our data or your systems? The ISM includes ISM-0141: the requirement for providers "to report cyber security incidents to a designated point of contact as soon as possible after they occur or are discovered is documented in contractual arrangements". ASD's engagement guide says the provider "must be obligated to notify the customer in the event of any cyber security incident that may endanger the customer network."
  2. Will you tell us if a backup job fails? Ask how failures are reported and how often (our recommendation).
  3. Can we see the logs of your access to our systems? ISM-1573 covers "Access to all logs relating to an organisation's data and services". ASD suggests the provider "should be obligated to provide detailed logs if the customer has security concerns they wish to investigate further."

ASD also reminds customers of their own duties after an incident: "If personal information has been lost or compromised, you may be legally required to report the cyber security incident to the Office of the Information Commissioner." In our reading, a provider's notice period should leave you time to meet that duty.

What a restore will cost

The following questions are our recommendation; ASD's guidance does not address pricing.

  • Is restoring included, or charged per request, per hour or per gigabyte? A large restore after an attack may be the most expensive event in the contract.
  • Are there storage retrieval or transfer charges passed through to you? Copies in colder storage tiers can carry retrieval fees.
  • Is out-of-hours or emergency work charged at a different rate?
  • What does a full exit cost, including handing back every copy?

Ask for a worked figure for restoring your largest system, in writing.

Where the data lives

  1. In which countries and regions are our backups stored and processed, and who can access them from where? ISM-1572 documents "The regions or availability zones where data will be processed, stored and communicated, as well as a minimum notification period for any configuration changes". The ISM notes that services "may be located offshore and subject to lawful and covert data collection without their customers' knowledge."
  2. Do you use subcontractors for storage or support? ISM-1395 expects that "Service providers, including any subcontractors, provide an appropriate level of protection for any data entrusted to them or their services."

What happens when the contract ends

  1. In what format can we take our backups with us? ISM-1574 covers "The storage of data in a portable manner that enables backups, service migration and service decommissioning without any loss of data". The ISM explains that "undocumented or proprietary formats may make it more difficult for an organisation to perform backup, service migration or service decommissioning activities."
  2. How much notice will you give if you stop the service? ISM-1575 documents "A minimum notification period of one month for the cessation of any services by a service provider".
  3. What happens to our copies after we leave? The ISM says contracts should address how data "will be protected during contractual arrangements and following the completion or termination of such contractual arrangements."
  4. Can we end the contract if security requirements are not met? ISM-1804 covers "Break clauses associated with failure to meet security requirements".

Proof, not promises

  1. Can we verify your controls? ISM-1571 documents "The right to verify compliance with security requirements", and ISM-1738 expects that right to be "regularly exercised."
  2. Can we speak to other customers? ASD suggests: "During negotiations, ask the MSP for contact information for other clients."
  3. Will you walk us through how you administer a customer's systems? ASD notes "you may ask a candidate MSP to walk through how they administer a customer's network."

Read-only checks

These checks review documents and settings; they change nothing. They involve no commands.

  1. Map the answers to the contract. For each question, note whether the answer appears in the signed contract or only in sales material.
  2. List provider accounts. Ask your current provider, or check your own directory, for every account their staff use on your systems, and whether each has multi-factor sign-in.
  3. Read one test report. Ask for the most recent restore test and check its date, what was restored and how long it took.
  4. Check the exit terms. Find the data format, notice period and deletion terms on leaving.

Documents show commitments. An observed restore demonstrates only the tested data, systems, dependencies and conditions. A successful file or sample restore does not establish a whole-server or multi-system service commitment (our recommendation).

Safe restore rehearsal

  1. Agree the scope with the provider before testing: named data/system, volume, dependencies, acceptable data loss and the recovery point to use. Define the clock start and end and the checks that mean the service is usable.
  2. Restore the agreed scope in an authorised isolated environment with no production connection, using synthetic or approved non-sensitive data. Record request, retrieval, restore and validation times against the agreed clock.
  3. Check the data against the baseline for the chosen recovery point and perform the agreed application and dependency checks. Record missing data and the actual recovery point.
  4. Compare like with like. A file/sample result supports only a matching file/sample commitment. Require a representative whole-system and dependency exercise before assessing a wider contractual recovery commitment; do not scale up a sample as measured proof.
  5. Record the tested scope, conditions, measured result and residual unknowns. Assign follow-up tests for systems or dependencies not covered.

Diagnosing what you find

  • The restore took far longer than promised: the promise covered a single file, not a server; data had to be retrieved from slow storage; or the request waited for business hours.
  • The provider could delete everything: backup systems share the provider's everyday sign-in; no retention lock is set; or one administrator role covers all customers.
  • You could not get logs of the provider's access: logging was never set up; logs are kept too briefly; or the contract does not give you access.
  • Exit terms are unclear: the backup format is proprietary; the notice period is not stated; or deletion on exit is not covered.

Worked example (illustrative)

The following is invented. A small firm compares two providers. One gives a typical restore time and a features sheet. The other puts a restore time for its main server in the contract, shows a dated test report, explains that its staff cannot delete backups during retention, and names the region where copies are stored. When asked about exit, the first cannot say what format the data would be returned in. The firm chooses on the answers, not the price alone.

Risks and limits

  • ASD's MSP publications date from 2021; check for newer versions.
  • ISM controls are written for government; adapt to your size and risk.
  • Good answers in a meeting matter only if they are in the contract.
  • This is general information, not legal advice on contract terms.

Sources

All accessed 14 November 2026.

Related future topics

  • Writing restore times into a backup contract
  • Leaving a backup provider without losing history
  • Separate sign-in for backup systems

This article was originally published on .