If you bought cyber insurance in the last couple of years, you signed an application. Somewhere past the middle there was a section about backups.
Most owners don't remember it. An agent filled it in, or the person who handles the computers did, or it got answered in a hurry between two other things. The policy bound. The form went into a folder.
That section is worth finding this week. It stopped being paperwork.
What the backup section asks
A current commercial cyber liability application opens the backup section with two easy questions: do you have a backup solution, and how often does it run. Continuous, daily, weekly, monthly.
Then it asks you to select everything that is true:
Backup servers are not joined to a Windows domain. Cloud based backups. Backup servers and user accounts use unique credentials. Multiple copies of backups stored in 2 or more geographical locations. Backup servers are segmented from the rest of the network. Backup solution with immutable backups. Copy of backups are kept offline or air-gapped. MFA required for access to backups.
Two of those need translating, because the words are doing a lot of work.
Immutable means the copy cannot be altered or deleted until its retention period runs out. Not by whoever is holding your administrator password, and not by you. The point is that an attacker who has taken over the account that manages your backups still cannot reach back and destroy the last clean copy.
Air-gapped means there is no path between the backups and everything else. Not a firewall rule, not a separate network segment. A gap that has to be crossed by a person, physically or by a deliberate step, before anything can touch that copy.
Further down, the same form asks whether you have a business continuity or disaster recovery plan, and if so, whether it has been tested in the last twelve months.
Those answers age
The form was accurate in the year somebody signed it. Things move after that.
A backup server gets joined to the domain because logging in separately was annoying. The person who used to run test restores takes another job. A new drive gets added and nobody checks whether the copy on it can actually be opened. The cloud copy is assumed to be fine because the invoice gets paid every month.
None of that is negligence. It is what happens when backups are treated as a chore that was completed once.
One box is enough
A law firm that writes about cyber underwriting put the change plainly in September: a single control that was not actually in place can support a denial of coverage, or a limit on the policy, and if the carrier decides the application was materially inaccurate, it can justify rescinding the policy entirely.
Read that again with your own form in mind. The question is not whether you have backups. It is whether the specific things you checked off are true today, and whether you could show someone.
That is a different standard, and it is the one that turns up in the week you least want to argue about it.
The test almost nobody runs
CISA's guidance for small businesses is short and unglamorous. Know what you are backing up. Keep three copies, on two kinds of media, with one off site. Then test.
Test a full restore and a partial restore. Be able to roll data back at least seven days. Know how to reach critical files without an internet connection.
Seven days is the number worth sitting with. If a problem starts on a Friday and nobody notices until Wednesday, a backup that only goes back forty-eight hours is not a backup. It is a copy of the damage.
Here is the version I would ask an owner to actually do. Pick a file you really use. Last month's invoice. The payroll spreadsheet. A job folder for a customer who called this morning. Restore it, on purpose, from the backup, and time how long that takes and who did it.
Then ask the harder question. If the server did not come back tomorrow, what would the business do on Thursday? Files are one thing. The program that reads them, the database behind it, the login, the printer that prints the tickets. A backup that restores files but not the thing that uses the files is half a plan.
Who this actually happens to
The FBI's 2025 Internet Crime Report counted 3,611 ransomware complaints last year. More than 1,400 of them came from businesses outside the sectors usually called critical infrastructure. The top three among those: legal services at 18 percent, contracting services at 17 percent, engineering and architectural firms at 10 percent.
Law offices, electricians, general contractors, surveyors. That is the Upper Peninsula's small business economy in a list.
The report also notes that the loss figures it collects do not include lost business, lost wages, or the cost of the outside help brought in afterward. The number is the smallest part of the story. The week is the story.
What to do about it this week
Find the application. Read the backup section. Then ask the person who runs your backups which of those boxes are true right now, and how they know.
If the honest answer to any of them is "I think so," you have it. Do not put a guess on a form that helps decide whether a claim gets paid.
A backup that has never been restored is a hope, not a plan. The good news is that finding out is cheap, and it is a lot cheaper in November than in the middle of it.