EN 
PT 
ES 
A backup assessment is an independent review of your company’s backup policy. From the kickoff meeting to the report, you learn what is protected, what is not, which recovery goals the policy can actually support and what to fix first. You get a written report with findings ranked by risk and recommendations in priority order.
At Integrity-UX the assessment is free, and it does not commit you to buying anything afterward. We look at the policy you already have, compare it with recognized best practices and hand you the picture in writing. What to do with it is your call.
This article explains when to ask for the review, how it works step by step, what we need from you, what the review covers and how to read the report. If you want the continuity context, our guide to disaster recovery plans (DRP) shows where backup fits.
Why review your backup policy before an incident
Almost every company has backups. Few can say, without checking with someone, exactly what those backups cover. The policy is usually written once, when the tool is bought, and then falls behind. New servers join the environment, a system moves, someone leaves the team, and the backup routine stays the same.
The problem shows up at the worst moment: when someone has to restore. That is when you find out a database was never in scope, that retention is shorter than a contract requires, or that the copies lived in the same environment that was hit.
Reviewing before an incident takes little time and lets you fix things calmly. Reviewing after one costs you downtime. CISA, the US cybersecurity agency, recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario. The assessment checks how close your policy is to that recommendation.
Who needs a backup assessment
The review is built for mid-size and large companies that depend on data and systems to operate. It makes the most sense when one of these signs shows up:
- nobody in the company can list, off the top of their head, what is in backup scope and what is not;
- the backup policy has not been reviewed in over a year, or was designed for an environment that has since changed;
- the company moved systems to the cloud, adopted Microsoft 365 or opened a new site, and backup did not keep up;
- there was an incident, a ransomware scare or a restore that took longer than expected;
- a customer contract, an audit or a legal requirement asks for proof of retention and recovery;
- backup is one person’s job, and that person is the only one who knows how it works.
If one or more of these sounds familiar, you will get value from the picture. If none does, the report documents that your policy holds up and gives you evidence for auditors.
How the assessment works, from kickoff to readout
The process has five steps. The timeline is tailored to each company and set in the proposal, because how long each step takes depends on the size of the environment.
1. Kickoff meeting
An alignment conversation with whoever owns IT and, when possible, someone from the business side. The goal is to understand what the company cannot do without, and how much time and data it can lose without serious harm. Without that conversation, the technical review has no yardstick.
2. Policy and environment intake
You send what already exists: the backup policy if there is one, the list of systems and servers, the tool in use and recent job reports. When there is no written policy, our team documents how backup works in practice.
3. Analysis
We compare the policy and the environment against best practices. The next section details what goes into that comparison. The analysis works from documents and configurations. Nothing is changed in your environment.
4. Report
The findings become a written document, with an executive summary for leadership and technical detail for the IT team.
5. Readout
A meeting to walk through the report, answer questions and agree on next steps. You leave with a to-do list in the order that makes sense.
What we need from your company
The assessment depends on reliable information, and the volume is small. For the kickoff and intake, it helps to gather:
- the current backup policy, even if it is a single page or a spreadsheet;
- the list of servers, databases, applications and cloud services, marking the most critical ones;
- the name of the backup tool and where copies are stored;
- job reports from the last few months, with successes, failures and alerts;
- the recovery goals you believe you have, if any;
- retention requirements from law, contracts or audits, where they apply;
- a point of contact who knows the environment and can answer questions during the review.
If an item does not exist, that is fine. A gap is also a finding and goes into the report. We do not need passwords or access credentials for the review, and you should not send them.
What the backup policy review covers
The review walks through the points that fail most often. Each becomes a concrete question the report answers.
Immutable or offline copy against ransomware
Many ransomware strains look for accessible backups to delete or encrypt, so that restoring is impossible unless the ransom is paid. The CISA #StopRansomware Guide makes exactly this point: it is important that backups are maintained offline. The review checks whether at least one copy is out of reach of an intruder who has access to your environment, whether offline, isolated or immutable.
Microsoft 365 backup
Mailboxes, OneDrive files and SharePoint sites are company data too. The review checks whether these services are in backup scope, how often they are copied and how long the copies are kept. In many companies, this is the gap nobody had mapped.
Retention required by law or contract
How long does each type of data have to be kept? The answer may come from law, a customer contract or an internal rule. The review compares what the policy keeps with what you tell us you need to keep, and flags anything that falls short or runs far over, since keeping too much also costs storage. Interpreting the legal obligation itself is a job for your legal team.
Failure alerts and monitoring
A backup that fails silently is worse than none, because it gives a false sense of safety. The review looks at whether failures raise an alert, who receives it and whether someone checks the reports on a regular basis.
RPO and RTO: your recovery goals
RPO is how much data the company accepts losing, measured in time. RTO is how long it takes for the service to be running again. Both are set together with the business, not by IT alone. Our article how to define RTO and RPO explains how to arrive at those numbers. In the assessment, we compare the goals you have, or say you want, with what your copy frequency and retention can support. The assessment does not set or promise an RTO or RPO. It shows whether your current policy is compatible with the goals you agree on.
The 3-2-1 rule and the 3-2-1-1-0 version
The 3-2-1 rule is the best-known backup reference. In its Data Backup Options document, CISA states it as: keep 3 copies of any important file, 1 primary and 2 backups, on 2 different media types, with 1 copy offsite.
Backup software vendors extend the rule. What Veeam recommends is a 3-2-1-1-0 rule: the same first three numbers, plus 1 immutable or air-gapped copy and 0 recovery errors, meaning you verify your backups so you know they restore. According to the blog, this version results in zero recovery errors and greater resilience against ransomware. It is vendor guidance, not a standard. Source: Veeam blog, the 3-2-1-1-0 backup rule, accessed November 11, 2026.
In the assessment, we use both as yardsticks. Does the current policy meet 3-2-1? Is there a copy out of an intruder’s reach? Is there any periodic check that backups really restore? The report shows where you stand and what is missing.
What the report includes
The report is written for two audiences: leadership, who need to decide, and the IT team, who need to execute. It has these parts:
- Executive summary: the situation on one page, with the top risks and what to do first;
- Scope and method: what was reviewed and on what basis;
- Current environment: how backup is set up today;
- Findings by risk level: each problem found, rated high, medium or low, with the reasoning;
- Prioritized recommendations: what to fix, in what order and at roughly what effort;
- Next steps and assumptions: what needs a decision from your company and what was assumed in the review.
The report may recommend changes or conclude that the current policy meets what the business needs. When it does, the report documents it, and you have evidence for auditors and customers.
Here is an example of a finding: the policy backs up every server every night, but the copies sit in the same location as the servers, reachable with the same administrator credential. The report rates this high risk and recommends an isolated or immutable copy outside that environment. The recommendation comes with a priority and a reason, so the decision belongs to whoever pays for it and not only to whoever operates it.
What happens after the assessment
After the readout, you choose the path. You can carry out the fixes with your own team. You can hire Integrity-UX to implement and manage your backup policies, which includes local, cloud and off-site copies, continuous monitoring, restore testing and written RTO and RPO goals. Or you can simply keep the report and come back to it later.
Backup is one piece of business continuity. If your next question is whether the company could operate after a major outage, our article on how to test a continuity plan and our disaster recovery plan page are the natural next step. Our backup page covers what Integrity-UX does in this area.
Next steps
If your company recognized itself in any of the signs above, the first step is a short conversation. Request the free backup assessment through the contact form. Our team replies and schedules the kickoff meeting.
Frequently asked questions
Does the backup assessment cost anything?
No. The assessment is free and does not commit you to any other Integrity-UX service.
Does the assessment include a restore test?
No. The assessment reviews the policy and the environment based on documents and configurations. Restore testing is part of the backup implementation and management service, when contracted.
Does the report always recommend changes?
No. If the policy meets what the business needs, the report says so. Recommendations appear when there is a gap against your goals and best practices.
What are RPO and RTO?
They are recovery goals, explained in the section on what the review covers. In short: how much data the company accepts losing and how fast the service has to be back.
What information does the company need to send?
The backup policy, the list of systems, the tool in use, recent job reports and retention requirements. Passwords and access credentials are not needed.
Is the 3-2-1-1-0 rule a standard?
No. 3-2-1 is guidance published by CISA. 3-2-1-1-0 is an extension described in Veeam’s own material, a backup vendor. We use both as comparison references.
How long does the assessment take?
It depends on the size of the environment. The timeline is tailored to each company and set in the proposal, after the kickoff meeting.
How do I request it?
Through the contact form. Our team gets in touch to schedule the kickoff meeting.
Last updated: November 11, 2026.
Sources: CISA, #StopRansomware Guide (September 2023 version), https://www.cisa.gov/stopransomware/ransomware-guide; CISA, Data Backup Options, https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf; Veeam, The 3-2-1-1-0 backup rule (official blog), https://www.veeam.com/blog/321-backup-rule.html (accessed November 11, 2026).
