Answer continuity questions with what you do, how often, and when you last proved it works. Backups that have never been restored are a hope, not a control. Give recovery objectives only if you have measured them or clearly label them as targets.
The usual questions
Reviewers ask whether you back up customer data, how often, where copies live, how long you keep them, whether you test restores and what your recovery time and recovery point objectives are. They also ask about disaster recovery plans and tests.
Know the terms
Recovery point objective (RPO). How much data, measured in time, you can afford to lose. It drives backup frequency.
Recovery time objective (RTO). How long you can take to restore service.
Label each as a target or a measured result. They are different claims.
Gather real facts first
- Frequency. Continuous replication, hourly, daily?
- Location. Same region, another region, another provider?
- Retention. How long are backups kept, and how is deletion handled when a customer leaves?
- Encryption and access. Who can read or restore backups?
- Restore tests. When was the last one, what did it cover and how long did it take?
If the answer to restore tests is "never", say so, and schedule one before the next questionnaire arrives.
Sample wording
"Customer data in our primary database is backed up daily, with copies stored in a second region and encrypted. Our recovery point target is twenty four hours and our recovery time target is a defined number of hours stated in our continuity plan. We performed a full restore test on a stated date and recorded the result."
Fill in real values. Delete the last sentence if you have not tested.
Disaster recovery exercises
A tabletop discussion and a technical failover test are different. Report which you did. If your plan relies on a cloud provider's regional resilience, explain which parts are yours.
Deletion and backups
Buyers who care about privacy ask how deletion requests apply to backups. Describe your retention window and that deleted data ages out of backups on that schedule. See what to publish on a trust page.
Keep evidence
Store the restore test record in your evidence pack, with the date and result. See the evidence pack layout.
Quick check
Is a replicated database a backup?
Not on its own. Replication copies mistakes and deletions too. A backup needs point in time recovery or an independent copy.
How often should we test restores?
Pick an interval you will keep, such as annually for the whole system and more often for critical data, and record each test.
Last reviewed: 19 October 2026.
