Questions to Ask Your Backup Vendor Before Your Firm Renews

Backup contracts tend to renew quietly. A line item shows up each month, the reports say "successful" and nobody revisits the arrangement until something goes wrong. A renewal date is a natural moment to check that the service still fits your firm, which has probably grown, changed systems and taken on new risks since the last review.

Here are the questions to put to your backup provider, whether it is your managed IT company or a separate vendor, before you sign again.

What Is Actually Protected?

1. Which systems and data sets are in scope? Ask for a written list: servers, file shares, document management, databases, laptops, Microsoft 365 mailboxes, OneDrive and SharePoint, and cloud practice-management exports.
2. What is excluded? Exclusions are where surprises hide.
3. When did scope last change? If you have added systems since the contract began, confirm they were included.

How Protected Is the Backup Itself?

1. Is at least one copy immutable or offline, so an attacker with administrator access cannot delete it?
2. Who can delete or alter backups, and are those credentials separate from your main network administrator accounts?
3. Is multi-factor authentication required to access the backup console?
4. Is data encrypted in transit and at rest, and who holds the encryption keys? A lost key can make a backup useless.
5. Where is the data stored geographically, and is that consistent with client requirements?

How Fast Can You Recover?

1. What are our recovery time and recovery point objectives, in writing? Recovery time is how long restoration takes. Recovery point is how much recent data you could lose.
2. What did your last restore test achieve? Ask for the date, scope, duration and result.
3. Can you restore a full server or environment in an emergency, and how? Some services only restore files, which is far slower for a complete rebuild.
4. What happens if our building is unavailable? Ask whether the vendor can bring systems up elsewhere and what that would involve.

What Happens in a Crisis?

1. Who do we call, and how fast will someone respond? Get response commitments for emergencies, including nights and weekends.
2. Is emergency restoration included, or billed separately at an hourly rate?
3. Is the vendor prepared for ransomware scenarios, such as scanning backups for infection before restoring?

What Does It Cost?

1. What is included in the base price, and what is extra? Common add-ons include storage growth, long-term retention, restore labor and test exercises.
2. How does pricing change as our data grows?
3. Are there fees to retrieve our data if we leave?

What Are the Contract Terms?

1. What are the term length, renewal and cancellation conditions? Watch for automatic renewals with long notice windows.
2. What service commitments exist, and what remedies apply if they are missed?
3. How is our data handled when the relationship ends? Ask about return, deletion and certificates of destruction.
4. What confidentiality terms bind the vendor and its subcontractors? ABA Model Rule 5.3 addresses supervising nonlawyer assistance, which can include vendors, so get these commitments in writing.

How to Use the Answers

Compare the responses against what your firm needs. If your partners say they could tolerate no more than a day of downtime and the vendor's honest estimate is three, you have learned something valuable. You can then decide whether to improve the service, change vendors or adjust expectations.

Document the answers and keep them with your technology records. They are useful when completing cyber-insurance applications and client security questionnaires, which often ask about backup practices.

Red Flags

• Vague answers about immutability or who can delete backups.
• No recent restore test.
• No written recovery objectives.
• Reluctance to share contract terms about data return.
• Heavy reliance on a single person who understands the setup.

How Counsel Cyber Helps

Counsel Cyber reviews existing backup arrangements for law firms and can provide an independent assessment before you renew. We are happy to look at your current setup, even if you decide to stay with your current provider.