Do you back up customer data?
A foundations question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. Customer data is backed up automatically [daily] and kept for [30 days], encrypted, in [a separate region or account]. Restores are tested [every quarter].
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- Your backup configuration in the database or cloud provider
- The date and result of your last restore test
If you don't do this yet
Managed databases usually back up by default; say which service and its retention. If you have never tested a restore, don't claim you have. Test one and write down the result.
Related questions
Do you have a disaster recovery plan?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.