Why Backup is Becoming a Policy Requirement — and What That Means for Your Organisation
Cyber insurance has become an essential component of business continuity planning. However, as cyber threats grow more advanced, insurers are tightening their requirements. One of the most significant emerging conditions is the requirement for Microsoft 365 (M365) backup — something many organisations still overlook.
At DSM, we’re seeing this shift first-hand, as clients look to ensure their data protection posture meets evolving cyber insurance standards. In this article, we explain what’s driving this requirement, what constitutes a compliant backup solution, and how businesses can prepare effectively.
Understanding the Change
Microsoft’s Shared Responsibility Model
Many organisations mistakenly believe that Microsoft fully protects M365 data. In fact, Microsoft’s cloud services operate under a shared responsibility model: they maintain the platform’s availability, but customers are responsible for protecting their own data against deletion, corruption, ransomware, and retention misconfiguration.
Native tools such as recycle bins and retention policies offer limited protection, often for short periods (typically 30–90 days), and do not meet insurer expectations for full recoverability.
The Rise of Cloud-Based Threats
Microsoft 365 environments are increasingly being targeted by ransomware, phishing, and Business Email Compromise (BEC) attacks. In these scenarios, data loss is common — and without third-party backup, often irrecoverable.
From an insurer’s perspective, the inability to restore critical business data significantly increases claim risk, operational disruption, and potential reputational harm.
What Are Insurers Looking For?
To reduce their exposure and improve resilience among policyholders, many cyber insurers now require customers to:
- Demonstrate that M365 data is backed up externally
- Show evidence of backup schedules and retention policies
- Confirm that data is restorable in full or in part
- Prove that storage is secure, monitored, and immutable
Insurers may request this information at the point of application, during renewal, or even during a claim investigation.
What This Means for Your Organisation
1. Backup Is Now Essential for Compliance
Whether you’re a regulated entity or a small business, having a suitable Microsoft 365 backup solution in place may now be a prerequisite for cyber insurance eligibility. Without one, insurers may:
- Decline coverage
- Increase premiums
- Apply exclusions for cloud-related losses
2. Greater Scrutiny During Due Diligence
Expect more technical questions from underwriters, such as:
- What backup technology do you use?
- How often is data backed up?
- What’s your retention period?
- Is backup data immutable?
- Have you tested your recovery processes?
3. Operational Benefits Beyond Insurance
Having robust backups of your Microsoft 365 environment doesn’t just satisfy insurers — it also strengthens your business continuity and disaster recovery planning, enhances compliance, and reduces recovery time in the event of an incident.
What Does a Compliant Backup Look Like?
At DSM, we recommend businesses deploy a dedicated backup solution that meets or exceeds the following criteria:
✔️ Comprehensive Coverage
Protection for all core Microsoft 365 workloads:
- Exchange Online (emails, calendar, contacts)
- OneDrive for Business
- SharePoint Online
- Microsoft Teams (chats, files, meetings)
- M365 Groups and Public Folders
✔️ Granular Recovery
Ability to restore individual items such as emails, documents, calendar entries, or conversations — not just full mailboxes or accounts.
✔️ Immutable Storage
Backups must be tamper-proof, using WORM (Write Once, Read Many) technology. This prevents attackers or internal users from modifying or deleting backup data — a key insurer requirement.
✔️ Automated Scheduling and Retention
Daily or more frequent backups, with configurable retention periods to align with organisational needs or regulatory obligations.
✔️ Role-Based Access and MFA
Administrator access to the backup platform should be restricted, audited, and protected by multi-factor authentication.
✔️ Data Location and Compliance
Ensure data is stored in a secure UK or EU facility, in accordance with data protection regulations such as GDPR and DPA 2018.
How DSM Can Help
At DSM, we offer fully managed Microsoft 365 backup solutions that align with the expectations of both cyber insurers and regulatory bodies. Our platforms are:
- Hosted within our UK-based Tier 3 data centre
- Integrated with secure, immutable backup storage
- Monitored and maintained by our accredited support team
- Available with custom retention policies and rapid recovery SLAs
Whether you’re looking to improve resilience, achieve cyber insurance compliance, or simply secure your cloud data, DSM can provide a tailored backup strategy to meet your needs.
Next Steps
If you’re unsure whether your current Microsoft 365 environment is sufficiently protected — or if your insurer has introduced new data protection requirements — we recommend taking the following steps:
- Audit your existing M365 backup arrangements
- Consult your insurer or broker to confirm their backup requirements
- Speak with a DSM advisor to explore compliant backup solutions
Get in touch today to discuss how DSM can help you meet cyber insurance standards with confidence.