Backup as a Service evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 37 vendors in this category.

• baselineRFIWhat workloads are covered natively — VMs, databases, SaaS apps (M365/Google Workspace/Salesforce), Kubernetes, endpoints — and which require separate products or licenses?weight 3
  Answer key — what a strong answer shows

  Look for a coverage matrix with licensing clarity; SaaS-app backup in particular is often a separately-priced product line despite unified marketing.

• baselineRFPDescribe ransomware resilience specifically — immutability (WORM/object-lock), logical air-gap, anomaly detection on backup streams, and a customer-referenced recovery from an actual ransomware event.weight 3
  Answer key — what a strong answer shows

  Immutability must be technical (object-lock/WORM with retention that admins can't shorten), not just access-controlled; a real customer ransomware-recovery story is the strongest evidence in this category.

• baselineRFIWhat are the measured RPO/RTO capabilities — backup frequency floors, instant-recovery/live-mount options, and mass-restore throughput for recovering hundreds of VMs after a site-wide event?weight 3
  Answer key — what a strong answer shows

  Single-VM restore demos hide the real constraint: mass-restore throughput after a site-wide incident — ask for measured large-scale recovery figures.

• baselineRFIHow is backup data encrypted and who holds the keys — customer-managed keys supported? Can the provider's own staff access or decrypt backup content under any circumstances?weight 3
  Answer key — what a strong answer shows

  Look for customer-managed key support and an explicit statement on provider-side access — backups concentrate your most sensitive data in one place.

• baselineRFPDetail recovery testing automation — scheduled restore verification, isolated recovery environment (clean-room) support for testing restores without touching production, and compliance-consumable test evidence.weight 3
  Answer key — what a strong answer shows

  Untested backups fail when needed; look for automated scheduled restore verification with evidence output, not a manual best-practice recommendation.

• baselineRFIWhat egress and restore costs apply — per-GB restore fees, cloud egress passthrough, and the all-in cost of a full-environment recovery scenario modeled on our data volume?weight 3
  Answer key — what a strong answer shows

  BaaS pricing surprises live in restore/egress fees — insist on a modeled full-recovery cost, not just the per-GB-protected rate.

• baselineRFPExplain retention and legal-hold capabilities — policy-driven tiering, deletion verification (provable erasure for GDPR), and legal-hold overrides with audit trails.weight 3
  Answer key — what a strong answer shows

  Look for both directions: provable deletion for privacy compliance and undeletable legal holds — with the interaction between the two explicitly handled.

• baselineRFIWhat happens at contract exit — bulk data export format/timeline/cost, and can backups be restored without the provider's platform after departure?weight 3
  Answer key — what a strong answer shows

  Exit viability is a real moat-versus-hostage distinction: look for a stated bulk-export path with standard formats and a committed timeline, not 'contact support.'

• baselineRFIWhat is the pricing model — per GB stored, per protected workload, or a flat capacity tier — and what is the all-in cost trajectory as data volume grows significantly, including any storage-tier or egress surprises not obvious from the headline price?weight 3
  Answer key — what a strong answer shows

  Look for transparent, predictable scaling economics and explicit disclosure of tiered-storage/egress cost triggers — backup pricing models are a common source of budget surprises as data grows.

• baselineRFPDescribe incident-response support if a ransomware attack is discovered actively encrypting data mid-backup-cycle — can the platform identify the last-known-clean recovery point with confidence, and what is a customer-referenced example of a real ransomware recovery using this exact capability?weight 3
  Answer key — what a strong answer shows

  Strong answers describe a specific mechanism for confidently identifying a clean recovery point (not just 'we have many restore points') and cite a real customer incident, not a hypothetical capability.

• baselineRFIWhat geo-redundancy exists for the backup data itself — is it replicated across multiple regions by default, and what happens to recovery capability if the primary backup storage region has an outage?weight 3
  Answer key — what a strong answer shows

  Backup data that itself has no geo-redundancy defeats part of the purpose of an offsite backup — ask for a specific multi-region replication answer, not just an assumption of single-region durability.

• baselineRFPWhat compliance certifications does the backup provider itself hold (SOC 2 Type II, ISO 27001), given it holds a complete copy of the customer's most sensitive data, and can the customer request the actual audit report?weight 3
  Answer key — what a strong answer shows

  A backup provider is itself a high-value target holding a complete data copy — insist on the real audit report, not just a compliance-badge claim.

• baselineRFIHow does the platform integrate with the customer's SIEM/SOC for anomaly alerting — is a detected backup-stream anomaly (e.g., a sudden mass file-encryption pattern suggesting active ransomware) surfaced in real time to the security team, or only visible within the backup vendor's own console?weight 3
  Answer key — what a strong answer shows

  Real-time SIEM-integrated alerting on backup-stream anomalies can serve as an early ransomware detection signal — ask whether this exists as genuine real-time integration or only a delayed, console-only view.

• baselineRFIDoes the platform support granular, item-level recovery (a single file, email, or database record) in addition to full-workload restore, and what is the typical time-to-recover for a single-item request versus a full restore?weight 3
  Answer key — what a strong answer shows

  Item-level recovery is a distinct, commonly-needed capability from full-environment restore — ask for a specific time-to-recover figure for the common single-item case, which is the vast majority of real-world recovery requests.

• baselineRFPWhat is the measured performance impact of backup jobs on production systems during the backup window, and can backup scheduling/throttling be tuned to avoid degrading production performance during business hours?weight 3
  Answer key — what a strong answer shows

  Backup jobs competing for production I/O/CPU resources is a real operational concern — ask for a measured impact figure and configurable throttling, not just an assumption that backups run invisibly in the background.

• baselineRFIWhat is the access model for third-party MSPs managing backups on the customer's behalf — is MSP access separately audited and revocable independent of the customer's own admin access, and what guardrails prevent an MSP from deleting backups the customer didn't authorize?weight 3
  Answer key — what a strong answer shows

  A common real risk is an MSP with overly broad, hard-to-revoke access to backup deletion — ask for a specific, separately-scoped and auditable MSP access model.

• baselineRFPProvide backup system administration, ensuring backup integrity and disaster recovery readiness.weight 3
• baselineRFPEnsure that backup systems are monitored daily, and disaster recovery plans are practiced annually, including validating backup integrity and performing tests to confirm system reliability.weight 3
• baselineRFPRecovery from the cloud shall not exceed a time frame of three (3) days.weight 3
• baselineRFPAutomatically back up all the organization's data files on Contractor IT systems in a format readily accessible and usable by the organization.weight 3
• baselineRFPThe solution shall provide full and incremental data back-up capabilities on a scheduled and ad-hoc basis, and must allow system administrators to perform restoration of content at all levels, from full database restoration to partial restoration of selected content.weight 3
• baselineRFPThe vendor shall incorporate backup protocols and guidance for how GRC will interact with current backup hardware and software for both file structure and work drives as well as disaster recovery systems.weight 3
• baselineRFPDo you use your own computing environment (including back-up and storage capacity)?weight 3

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.