What to ask your agency about backups

The gap between knowing this and actually doing it is where most teams lose ground. If you are briefing an agency or a freelancer on backups, these questions are worth asking early.

Security is a maintenance habit rather than a purchase, which is why it drifts. Budget a little time for it every quarter and it never becomes a project of its own.

Questions worth asking

• Who will actually do this work, and have they done it before?
• How will we know afterwards whether it worked?
• What happens if it needs changing in a year?
• What are you assuming that we have not confirmed?

What a good answer sounds like

An untested backup is a hope, not a backup. The teams that handle this well are rarely the ones with the biggest budgets. Assume whoever inherits this will have half your context and none of your patience.

Know how long a restore actually takes. None of that requires a large budget, only a decision and someone to own it. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

In practice

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about backups before you move on:

• Someone can say what the current setup is without going to look
• Know how long a restore actually takes — and you know whether that is true here
• There is a way to tell whether the last change to this helped

The point is not perfection, it is knowing which of these you have consciously chosen to skip.