Choosing a backup provider: the questions worth asking

Start with what you need protected

Before talking to anyone, list what needs backing up: Microsoft 365 or Google Workspace, any servers or NAS devices, laptops with local data, cloud accounting or practice systems, and anything else important. Note roughly how much data each holds and how quickly you would need it back. That list becomes your requirement, and it stops a provider steering you toward a product that suits them rather than you.

Some providers specialise in cloud apps, others in servers and devices, and some cover both. One provider for everything keeps things simple; two specialists can be better if your needs are unusual. Either way, every item on your list should have a clear answer. Be wary of a proposal that quietly leaves something off, such as shared mailboxes, a NAS in the back room or the accounting database.

Coverage and data location questions

Ask exactly what is included. For 365, does it cover mail, OneDrive, SharePoint, Teams and shared mailboxes? Are new users and sites added automatically? Is there a limit on storage or on the number of versions kept? For servers, does it take full images and support application-aware backup of databases? For laptops, does it work when staff are away from the office?

Ask where backup data is physically stored and whether you can choose the location. Some clients, government contracts and regulated industries require data to stay in New Zealand or Australia. Ask whether the provider uses its own data centres or a large cloud platform, and whether copies are kept in more than one location in case a data centre has problems.

Retention, immutability and restores

Ask how long backups are kept, whether you can set different retention for different data, and what happens to former users' data. Ask whether copies can be made immutable, locked against deletion for a set period, and whether that is included or extra. This matters for ransomware protection and is increasingly asked about on cyber insurance forms.

Then ask about restores, which is where providers differ most. Can you restore a single email, a folder or a whole account? Can you restore to a different location? How long would a full restore of your largest system take? Are there fees for restoring or downloading large amounts of data? Can they ship a drive if downloading would be too slow?

Security and access

Ask whether data is encrypted in transit and at rest, who controls the keys, and whether you can set your own passphrase. Ask whether the backup console supports multi-factor authentication and separate admin accounts, and whether it can be restricted so an attacker with your normal admin credentials cannot delete backups.

Ask how the provider's own staff access customer data, whether that access is logged, and what certifications or independent audits they hold. Ask how they would notify you if they had a security incident themselves. A provider that answers these clearly is more likely to take security seriously. Vague or evasive answers are worth noting when you compare options.

Monitoring, support and reporting

Find out who checks the backups every day. If the provider only supplies software, someone in your business or your IT provider has to do that work. If it is a managed service, ask what they monitor, how quickly they act on failures, how often they test restores and whether you receive a regular report.

Ask how support works when you need a restore urgently: hours, response times, how to reach them, and whether help is local or overseas. Remember that during a real incident you may not have email, so check there is more than one way to get help. Keep the support details in your recovery plan, not only in an email folder.

Contract, cost and leaving

Ask about minimum terms, how pricing is calculated, what is likely to change at renewal, and what costs are not included. Ask whether former users or extra storage cost more. Get the answers in writing. Check whether the price includes monitoring and test restores or only the software and storage, because the cheapest quotes often leave that work for you to do yourself. Ask too whether the provider will help with a large restore at no extra charge, or whether emergency work is billed separately.

Finally, ask how you would leave. Can you export your data in standard formats? How long do they keep your data after you cancel, and how do they confirm it has been deleted? A provider that makes leaving difficult can hold your data, and your choices, hostage. If you would like a second opinion, the Office IT health check covers existing backups and what a replacement should include, but the questions above are useful whoever you talk to.