How do I answer the cyber insurance questions about testing backups and time to restore?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Estimated amount of time it will take to restore essential functions using backups in the event of a widespread malware or ransomware attack within your network?

Based upon testing results, how long does it take to restore the Applicant's critical business operations following a network or systems interruption?

Please provide details on how you test your backups, including details on how frequently you test the full restoration and recovery of key server configurations and data from backups:

What does it mean for a small firm?

A backup that has never been restored is untested. One form asks for the time based on testing results, and offers Unknown as an answer.

How do I answer it truthfully?

Restore a set of files, and if you can a whole system, and time it. If you have not done that, Unknown is the true answer where the form offers it.

Can an outside reading check this?

An outside reading cannot see backups or restores. Nothing inside your network, your devices or your accounts can be seen from outside, so this cannot be checked that way. Only your own settings and records can show it.

Which questions sit next to this one?

• Backup frequency
• Incident response plan