Key takeaways
- A good agency backup covers your management system data, email, shared files, scanned policy documents and accounting, not just one computer.
- Microsoft 365 and Google Workspace keep deleted items for a while, but that is retention you do not control, not a backup.
- Follow the 3-2-1 idea: a local copy for fast restores, a cloud copy for disasters, and at least one copy that ransomware cannot reach.
- A backup nobody has restored from is a hope, not a plan; I test restores on a schedule and send you the result.
- I set this up for Dallas agencies remotely in most cases, either inside managed IT or as a one-time hourly project.
The short answer: who sets up better backups for an insurance agency?
I do. I am Anthony Omini, owner of Cross River Tech, a small managed IT company in Dallas, and the person you deal with directly. Building backups that actually restore is one of the most common projects I take on for independent insurance agencies. Better backups for an agency means three things: every place your data lives is covered, at least one copy sits somewhere ransomware cannot touch, and somebody has restored a file from it recently and can show you the proof.
Most agencies that call me already have something they call a backup. Usually it is an external drive plugged into the computer that runs the agency management system, or a checkbox in a cloud service that nobody has looked at since the day it was turned on. Neither one is worthless, but neither one would get the agency back to writing policies the morning after a ransomware infection or a burst pipe in the office.
The rest of this article walks through what needs to be backed up, why the tools you already pay for are not enough on their own, what a sound setup looks like, and how I test it. If you would rather skip the reading, tell me how your agency is set up and I will tell you what is missing. I support agencies across Dallas and the rest of the metroplex, and most of this work is done remotely, which keeps it quick and inexpensive for you. You can read more about how I work with agencies on the IT support for insurance agencies page.
What does an insurance agency actually need to back up?
When I sit down with an agency owner, the first thing I do is list every place client and policy information lives. It is always more than one. A typical Dallas agency with five to twenty people has data in most of these spots:
- The agency management system. Applied Epic, AMS360, HawkSoft, EZLynx, QQCatalyst or something similar. Hosted versions keep the database in the vendor's cloud; older installs keep it on a server or a desktop in your office.
- Email. Years of correspondence with clients, carriers and underwriters, plus the attachments that never made it into the management system.
- Shared files. The office shared drive, a NAS, a SharePoint site or a Google Drive full of ACORD forms, COIs, claims photos and spreadsheets.
- Scanned documents. Signed applications, ID copies and endorsements that went through the copier to a folder somewhere.
- Accounting. QuickBooks or a similar file, along with commission statements and trust account records.
- Phone recordings and voicemail. If your phone system records calls for E&O purposes, those recordings are data too.
- Individual computers. The desktop folder of the producer who saves everything locally, and the laptop that goes home every night.
Anything on that list that only exists in one place is one failure away from being gone. The goal of a better backup is not fancy software; it is making sure every item above has a second copy you control and a third copy an attacker cannot reach.
Isn't my agency management system already backed up by the vendor?
Partly, and this is where a lot of agencies get a false sense of safety. If you use a hosted management system, the vendor backs up their platform so the service itself survives a hardware failure on their side. That protects them, and it protects you against their data center burning down. It does not protect you against a user deleting the wrong client, a bad import that overwrites a year of activity notes, or an account takeover where somebody with your credentials exports your book and wipes it.
The practical answer is to ask the vendor two questions in writing: how do I get a full export of my data, and how far back can you restore a single record for me? Then schedule that export. Most systems can produce a client and policy export on a regular basis, and I set it to land in a folder that is itself backed up. That way your book of business exists in a format you own, not only inside a subscription you rent.
If your management system still runs on a server in the office, the whole conversation is different. That database is now the most valuable file in the building and it needs an application-aware backup, meaning one that captures the database in a consistent state rather than copying files while they are open. I cover that kind of setup in more detail in the article on IT support for Applied Epic, AMS360 and agency management systems. Either way, the vendor's backup is a nice safety net for the vendor. Yours has to be yours.
Why Microsoft 365 and Google Workspace are not a backup
Both platforms are excellent, and both keep deleted email and files around for a while. That feature is called retention, and it is designed to catch a mistake within a window of days or weeks. It is not designed to give you last month's mailbox back after an attacker has cleaned out a producer's inbox, and it is not designed to undo a ransomware infection that encrypted a synced folder and quietly pushed the encrypted versions up to the cloud.
The sync problem is the one that catches agencies. OneDrive, Google Drive and Dropbox mirror your local folder to the cloud. That is their whole job. When malware encrypts the files on a laptop, the sync client faithfully uploads the encrypted copies, and the good versions age out of version history in whatever window the service allows. I have watched people discover this the hard way, and it is not a pleasant afternoon.
The fix is a separate backup of the cloud tenant. There are several inexpensive services that back up Microsoft 365 or Google Workspace mailboxes, OneDrive and SharePoint, or Drive and shared drives, to storage that has nothing to do with Microsoft or Google. They run automatically several times a day, keep versions for as long as you decide, and let me restore one email, one folder or one whole account to any point in time. For most agencies this is the single highest-value addition I make, because email is where the audit trail of every conversation with a client lives. Setting it up is a routine part of my Microsoft 365 and Google Workspace support.
What does a good backup setup look like?
The rule I build around is called 3-2-1: three copies of your data, on two different kinds of storage, with one copy offsite. I add one more condition for the ransomware era: at least one copy has to be unreachable from the office network, either because it is offline or because the storage will not allow changes for a set number of days. Here is how that maps to a small agency.
| Copy | Where it lives | What it is for | How fast a restore is |
|---|---|---|---|
| Working data | Your management system, mailboxes, shared drive | Day-to-day work | Not applicable |
| Local backup | A backup appliance or NAS in the office, on a separate login from your users | Fast recovery from a failed drive, a deleted folder or a dead computer | Minutes to an hour or two |
| Cloud backup | Backup storage in a data center outside the building | Fire, theft, flood, or a ransomware event that reaches the local copy | Hours, depending on internet speed and data size |
| Immutable or offline copy | Cloud storage with a lock that prevents deletion, or a rotated offline drive | The worst case: an attacker with your admin credentials | Hours to a day |
For a hosted management system, the local and cloud copies are the scheduled export plus the file and email backup. For an in-office server, the local copy is an image of the whole machine, which means I can bring the server back on new hardware or even as a temporary virtual machine while a replacement arrives. Everything on this table is standard, well-supported technology. What makes it work is that somebody sets it up thoughtfully and then watches it. That is the part I take responsibility for, and it is included in the cybersecurity, backup and disaster recovery service.
How often should backups run, and how long should the agency keep them?
Two questions decide this, and I ask them in plain terms. First: if the system went down right now, how much work could you afford to re-enter? For most agencies the honest answer is a few hours, not a day. That sets how often the backup runs: mailboxes and cloud files several times a day, the shared drive and any local database at least every few hours, and a full image of any server nightly. Second: how long could you be down before it hurts? That decides whether you need a local copy that restores in minutes or whether a cloud restore over a day is acceptable.
Retention is the other half. Insurance is a paper-trail business. Your E&O carrier, the Texas Department of Insurance and the carriers you represent all expect you to be able to produce records from years back, and an email from a client about a coverage they declined can matter long after the policy expired. I set backups to keep daily versions for a rolling window, weekly versions for months, and monthly or yearly versions for as long as your records policy says. Storage is cheap compared with a claim you cannot document.
I also encourage every agency to write the answers down in a one-page recovery plan: what gets restored first, where the backup credentials are kept, who calls whom. It sounds bureaucratic. It is the difference between a bad morning and a bad month. If you have a plan already, I will read it and tell you where it would break. If you do not, I will draft it with you as part of the setup.
How do backups help with cyber insurance and E&O renewals?
You have probably seen the cyber insurance questionnaire that arrives with every renewal. It asks whether you keep backups offsite, whether they are separated from your network, whether they are encrypted, whether you test restores, and whether multi-factor authentication is turned on for email and remote access. Carriers ask because those controls decide whether a ransomware event is a nuisance or a total loss for them.
A backup set up the way I described above lets you answer yes to the backup questions truthfully, and I can give you a short written description of the setup to attach to the application. That helps you meet the requirements of most small-business cyber policies I have seen, and it often makes the difference between being offered coverage and being asked for more information. To be clear, I do not decide what a carrier will accept; I make sure what you say on the form is true and can be shown.
The same thinking applies to your own E&O exposure. If a client claims you never told them about a coverage gap, the email thread and the activity note in your management system are your defense. A backup that keeps versions for years means that evidence survives a departed employee, a retired computer, or a mailbox cleanup. I cover the wider set of security controls agencies in Texas are being asked about in the article on insurance agency cybersecurity and compliance in Texas; backups are the part of that picture you will be most grateful for.
How do you know the backup actually works?
You restore something from it. That is the whole test, and it is the step almost everyone skips. A backup job that reports success every night can still be backing up the wrong folder, skipping an open database, or writing to a drive that has quietly filled up. The only proof is a file coming back and opening correctly.
Here is the routine I follow for agencies I look after:
- Daily: I check the job reports. A failure or a warning gets looked at that day, not at the end of the month.
- Monthly: I restore a handful of random files and one mailbox item to a test location and open them.
- Quarterly: For an in-office server, I boot the backup image as a temporary virtual machine and confirm the management system starts and a user can log in.
- Yearly, or after any big change: A tabletop walk-through with you. Pretend the office is inaccessible, and talk through exactly what would happen in the first day.
Every one of those steps produces a short note that I send you. You should never have to wonder whether the backup is fine. If you currently have an IT provider and you cannot remember the last time they showed you a restore, that is worth asking about. Storage and software matter, but attention is what makes a backup trustworthy, and attention is easier to get from an owner who knows your office and answers the phone than from a ticket queue.
What does it cost, and how does the project start?
Backup costs come from three places: the software or service subscription, the storage, and the labor to set it up and keep watching it. Subscriptions for cloud-to-cloud backup are typically priced per user per month and are modest for a small office. Cloud storage for server or file backups is usually priced by the amount kept. A local backup appliance or NAS is a one-time hardware purchase sized to your data.
For labor, there are two ways to work with me. If your agency is on my managed IT plan, managed backup and disaster recovery is already part of the monthly fee, along with the monitoring and restore testing above. That plan is quoted per user or per device after a short conversation, and it is month-to-month with no long contract. If you only want the backup fixed and nothing else, I do it as an hourly project at my published break/fix rates, which are $100 per hour remote and $150 per hour onsite during business hours. Most backup work is remote.
The project itself is straightforward. I spend a short call learning where your data lives and what you already pay for. I send a one-page plan with the copies, schedules and retention I recommend. Once you say yes, the setup is usually done within a few working days, the first full backups finish over a night or two, and I do the first restore test before I call it finished. From then on it runs quietly, and you hear from me when something needs a decision. Call or email me and tell me the name of your management system and roughly how many people you have; that is enough for me to give you an honest first opinion.
Questions people ask
Who sets up better backups for an insurance agency in Dallas?
I do. Cross River Tech is a small, owner-led managed IT company in Dallas, and backups for independent agencies are a regular project for me. I cover the management system export, email, shared files, scanned documents and accounting, put one copy where ransomware cannot reach it, and test restores on a schedule. Most of the work is done remotely, so it is quick and inexpensive.
Is the backup my agency management system vendor provides enough?
No. A hosted vendor backs up their platform so their service survives a failure on their side. That does not protect you from a deleted client record, a bad import, or an account takeover that exports and wipes your book. Ask the vendor how to get a full export and how far back they can restore a single record, then schedule that export into a folder that is backed up under your control.
Does Microsoft 365 or Google Workspace already back up my email?
They keep deleted items and older file versions for a limited window, which is retention, not a backup. Sync clients also upload ransomware-encrypted files just as faithfully as good ones. A separate backup of the tenant, stored outside Microsoft or Google, lets me restore a single email, a folder or an entire mailbox to any point in time and keep versions for as long as your records policy requires.
How often should an insurance agency back up its data?
Often enough that you could afford to re-enter whatever was lost. For most agencies that means mailboxes and cloud files several times a day, the shared drive and any local database every few hours, and a full image of any in-office server nightly. Keep daily versions for a rolling window, weekly versions for months, and monthly or yearly versions for as long as your E&O and carrier record-keeping expectations call for.
Will a good backup help with my cyber insurance application?
It helps you meet the backup questions on most small-business cyber questionnaires: offsite copies, separation from the office network, encryption and tested restores. I can give you a short written description of the setup to attach to the application. I do not decide what a carrier will accept, but I make sure everything you claim on the form is true and can be shown if they ask.
How much does it cost to have backups set up for a small agency?
Three things add up: the backup subscription, the storage, and labor. Cloud-to-cloud backup is typically priced per user per month and is modest for a small office. If your agency is on my managed IT plan, managed backup and restore testing are already included. As a standalone project I bill at my published hourly rates, and because most of the setup is remote it is usually a matter of a few hours spread over a few days.
Sources and further reading
Market price ranges in this article are my own observation of quotes in the Dallas market, not a published survey. Where I state a rule or a standard, the source is linked above.
