This cloud backup checklist marks a hybrid or multi-cloud estate on 12 checks in four groups: coverage, policy, copy placement and proof. Each row names a question, the proof to save and a test for a full mark, so keep a sheet with one row for each check.
Last reviewed 2026-11-02 by Manish Sharma.
The reader here is an IT manager or IT head at a firm of roughly 250 to 2,000 people in India or the GCC. Such a firm runs servers on premises, workloads in one or two clouds and several SaaS applications. Across all of these, the sheet rates the estate as a whole, not the jobs of each system. The marks are Signisys’ own working method. Besides that, the sources are AWS and Microsoft documentation pages, not local rules. In addition, three related Signisys articles cover other ground: the order of work across environments, why protection gets harder across a hybrid estate, and the choice between each environment’s own tools and one platform.
Cloud Backup Checklist in Short: 12 Checks, Four Groups
A cloud backup checklist at estate level asks whether each environment is on the list, follows the same rules and keeps its copies apart from the source. Also, it sits under the Signisys use case on protecting data across hybrid and multi-cloud environments.
The sheet rates the estate, not each job. Coverage and owners: checks 1 to 3. Policy across environments: checks 4 to 6. Copies, access and responsibility: checks 7 to 9. Proof and one view: checks 10 to 12. The top mark is 24 for 12 checks, and the total certifies nothing.
Some ground sits outside the sheet. Job runs, alerts and restore samples belong to the live checklist of jobs, alerts and restore tests. For example, the recovery plan and its targets have their own reviews, and the limits section below points to them. Likewise, the order of work and the choice of approach are covered in other Signisys articles.
For example, take a firm in Pune with a server room, one subscription with a cloud provider and a SaaS office suite. Then, before any other row, that firm lists three environments and names an owner for each.
Coverage comes first: policy and placement mean little until the sheet lists each environment. The groups run in that order, and the fix order later starts with the same three rows.
What Earns a Point: Confirmed, Inferred or Open
Start a sheet with one row per check and one column for each environment. Each row then earns one of three marks.
- Confirmed (2 points): a person opened the setting, the console or the record in the environment itself, and saved a dated copy that a reader outside the session can open.
- Inferred (1 point): the answer comes from a policy document, a report from another team or a setting in one environment that someone takes to match the rest.
- Open (0 points): no owner can answer the question, or what the row asks for is not there.
A row that fits nothing in the estate is struck out as N/A, and the maximum shrinks by 2 for it. For instance, check 12 does not apply to a firm that has not added an account; 24 becomes 22. If a row says “each”, then the lowest-scoring environment sets the mark. The marker should be someone who does not run those environments. The sheet sets no target and no bands, because 24 is 12 full marks added up.
A worked case for check 4 follows; it is invented, not a client. The written policy keeps finance records for a stated period. A marker opens the on-premises job setting and the cloud account’s policy setting, and each shows that period: Confirmed. If the marker opened only the on-premises setting, the mark is Inferred.
Key Takeaway A setting read in one environment says nothing about the others, so a row marked from one environment scores Inferred, whatever the policy document says.
Cloud Backup Checklist, Group 1: Coverage and Owners, Checks 1 to 3
This group asks whether the sheet lists everything the firm runs, and who answers for each part.
| Check and question | Proof to save | Confirmed when |
|---|---|---|
| 1. One list of each environment and SaaS service, each with an owner. Does the list name each on-premises site, each cloud account or subscription and each SaaS service that holds business data? | The list, dated, and the second source it was compared with: the sign-in directory’s application list or the cloud organisation’s account list. | Each line has a named owner who has seen it, and the comparison is saved. |
| 2. A named backup for each line. Which service or product covers each line, or why does none? | The list, with a column for the backup. | Each line names a backup or a written reason. |
| 3. Backups taken outside the main tool are on the list. Where does anyone take a backup outside the tool that reports on the rest? | A dated note for each environment. | Each environment’s owner has confirmed the answer in writing. |
The AWS Backup developer guide says that AWS Backup does not govern backups you take in your AWS environment outside of AWS Backup. Then ask a plain question for each environment: what would a report from that service show about those backups?
In other words, check 3 exists for those corners, for example a database team’s own scripts, an export someone runs by hand, or a copy a SaaS administrator keeps on a laptop.
Group 2: Policy That Matches Across Environments, Checks 4 to 6
This group compares the setting in each environment with the one written policy. The Azure Backup overview on Microsoft Learn describes a backup policy in which you define the schedule, frequency and retention for Azure Backup. Similarly, read each other service’s own page the same way, for what its policy sets.
| Check and question | Proof to save | Confirmed when |
|---|---|---|
| 4. The same data class carries the same retention rule everywhere. Does the setting in each environment match the written rule for that class? | The rule, and a screenshot of each setting. | A person opened each setting and found that it matches the rule. |
| 5. The same class carries the same schedule everywhere. Does each environment’s schedule for the class match the others? | Each schedule setting, dated. | A person opened each setting, and each one matches or has a written difference. |
| 6. An exception to the shared policy carries a named owner and a date. Where does an environment not follow the shared policy, and who closes the gap? | The exception record. | Each exception names an owner, a reason and a date. |
However, check 5 scores only whether schedules match across environments. Whether a schedule meets the recovery point is a job question, and the live list of jobs and restore tests scores it. In addition, the AWS Backup page describes applying a backup plan to a group of resources by tag. Where a service applies plans by tag, a newly tagged system may join the plan. Even so, check 12 asks the earlier question: does a new system reach the sheet at all?
Group 3: Copies, Access and Responsibility, Checks 7 to 9
This group asks where the copies sit, who can reach them and who answers for each service. First, both provider pages bear on check 7. The AWS Backup page describes copies across Regions and across accounts. Meanwhile, the Azure Backup overview lists vault design across subscriptions, regions and environments among its design considerations.
| Check and question | Proof to save | Confirmed when |
|---|---|---|
| 7. A copy sits outside the source account, subscription or tenant. For each environment, which login that can delete the data can also delete the copy? | The account or vault layout, and the list of identities. | A person opened the layout and attached the identity list. |
| 8. Keys and access are listed for each environment. Which identity reaches the copies in each environment, and does one identity reach all of them? | The access list for each environment. | A person opened each list and named any shared identity, with a reason. |
| 9. The shared responsibility is written for each service. What does the provider’s page say it covers, and what stays with the firm? | One line per service, with the page and its date. | Each line cites the provider’s own page. |
As for check 9, Microsoft’s page on shared responsibility in the cloud says that, regardless of the type of deployment, you retain responsibility for your data. Its responsibility matrix marks customer data as the customer’s in on-premises, IaaS, PaaS and SaaS alike.
In Signisys’ view, write check 7 first for the class of data the business has no other way to rebuild. Once that class has a separated copy and a named list of logins, extend the row to the other classes.
Group 4: Proof and One View, Checks 10 to 12
This group asks whether one restore crossed a boundary and whether one person sees the whole estate in one place. It also asks whether new systems arrive on the sheet.
| Check and question | Proof to save | Confirmed when |
|---|---|---|
| 10. One restore read from the separated copy. Did a restore use the copy from check 7, not the copy beside the source? | The restore record, naming the copy and its location. | A person read the restored result and saved it. |
| 11. One view of status across environments. Where does one named person see protected and unprotected systems for each environment, and what does that place not show? | A screenshot of the view, and a list of what it leaves out. | Both exist, and the person is named. |
| 12. A new account, subscription or SaaS service reaches the sheet before it holds business data. Who tells the sheet’s owner when a new environment appears? | The route, and one example. | The route is written down, and one recent addition went through it. |
Key Takeaway A restore that read the copy beside the source scores Open on check 10, even if it worked.
Check 10 scores only the choice of copy. Instead, restore samples and their timing belong to the live list of jobs, alerts and restore tests. Likewise, for the tool side of check 11, see the criteria for choosing what watches your jobs.
Finally, one question for the marker: what does a restore that stayed inside one boundary show about the separated copy?
After Scoring Your Cloud Backup Checklist: Where to Start Fixing
Look at the rows first and the total second. Then add the marks, compare them with the reduced maximum and record the result as “x of y”. However, one Open row on check 1 can undo several Confirmed rows elsewhere. For that reason, a scored cloud backup checklist is worked in a fixed order, shown below.
Fix Open rows on checks 1 to 3 first: nothing else counts for a system the sheet does not list.
Work through checks 7 and 8.
Write check 9 for each service.
Bring checks 4 to 6 into line.
Finish with checks 10 to 12.
In Signisys’ view, the class of data the business has no other way to rebuild goes first within each group. Then the other classes follow. For example, if checks 1 and 7 are both Open, close the list before you separate any copies.
Finally, after each fix, the row’s owner marks that row again, and nobody redoes the whole sheet.
Limits of the Cloud Backup Checklist, and When to Ask for Help
A mark records what the marker found on the day of scoring, but evidence can look complete only to the person who gathered it.
Also, the AWS and Microsoft pages are provider documentation and set no Indian or GCC rule. Where data may sit and what a copy must meet are for your regulator, your contract or your auditor to settle. The pages were read on 2 November 2026. The Azure Backup overview was last updated on 16 September 2026 and the shared responsibility page on 24 August 2026, while the AWS Backup page carries no date.
For the plan, see what a data recovery plan should hold. Recovery targets have their own Signisys assessment. The order of work, the choice of approach and the reasons protection gets harder are covered in other Signisys articles. Finally, for the wider problems, read the challenges of running a hybrid estate.
Ask for outside help when one of these is true:
- A second reader marks several rows Open that the first reader marked Confirmed, and the two do not agree on what the evidence shows.
- One data class carries different retention rules in two environments, and nobody can say which rule applies.
- All rows for one environment stay Open, and its team will not share the evidence.
Signisys provides data protection, backup and cyber recovery solutions as well as cybersecurity services. Read this paragraph as a description of a Signisys service, not neutral advice. The hybrid and multi-cloud data protection use case sets out the approach.
Cloud Backup Checklist FAQ
Does a cloud backup checklist for one cloud and one data centre still apply?
Does a copy in another region count as kept apart?
How does an approved exception score on check 6?
Which row covers a SaaS service nobody in IT set up?
What counts as Confirmed when the evidence sits in another team’s console?
How do we keep the sheet when different teams hold the evidence?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.