Managed backups and recovery planning: a buyer’s checklist

Turn downtime into a recovery brief

For each critical system, write down the maximum acceptable data loss and the time the business can operate without it. These are planning targets, commonly called recovery point and recovery time objectives. They are not provider guarantees until the scope, dependencies and agreement support them.

Prioritise the smallest usable recovery: for example, staff may need order records before historical attachments. Include identity, DNS, application configuration and encryption-key access, not just database files.

A successful job is not a proven restore

Ask for a restore demonstration into an isolated environment. Check that an authorised person can sign in, open representative records and complete an important business action. Record the backup used, elapsed recovery time, validation steps and unresolved failures. Do not expose real customer data in a public demonstration.

• Name the person responsible for backup failures and their escalation route.
• Confirm retention, deletion, encryption and separation from production credentials.
• Include copies that cannot be changed by a compromised production account.
• Agree a restore-test schedule and keep dated, access-controlled evidence.
• Check recovery costs, bandwidth limits and access to keys if the supplier is unavailable.

Make handover part of the contract

Request a recovery runbook and an export procedure before signing. Specify who can authorise a restore and how staff will communicate during an outage. Review the plan when systems, data volumes or business priorities change.

NIST’s small-business guidance places preparation and recovery within broader risk management. This checklist is a procurement aid, not a claim that a particular CloudMonkey backup package has achieved a restore target. Confirm your agreed managed-cloud scope in writing.