FAQs
Have Questions?
What does a BCDR audit cover?
A backup and disaster recovery audit covers backup coverage against system inventory, retention against business and compliance requirements, restore testing for sample workloads, the 3-2-1 rule compliance, off-site copy validation, SaaS data protection including Microsoft 365, and a walkthrough of the documented DR plan against the customer's actual capability to execute it.
Do you actually test restores during the audit?
Yes. Audit findings need evidence. CinchOps performs sample restores against a representative selection of systems in a non-disruptive way, usually to an isolated environment. The restore tests validate that backups are functional, that the documented RTO is achievable, and that the customer's DR runbook covers the actual steps needed to restore.
Will the audit cover Microsoft 365 data?
Most Houston SMBs assume Microsoft backs up their 365 data. Microsoft does not, except in narrow scenarios. The audit explicitly reviews M365 protection across Exchange, SharePoint, OneDrive, and Teams. If a third-party backup product is in place, the audit verifies coverage. If not, the audit flags it as a gap to address.
How long does a BCDR audit take?
For a typical Houston small or mid-sized business, a full BCDR audit runs two to three weeks. The variation depends on the size of the environment, the number of backup products in use, and how much restore testing the customer wants performed. The audit ends with a written report and a prioritized remediation plan.
How often should BCDR be re-audited?
Annual audits are the floor. Mid-market businesses that change rapidly or operate under HIPAA, PCI DSS, or SOC 2 obligations usually benefit from quarterly lighter reviews and an annual deep audit. Backup configurations drift, retention rules change, and new systems get added without backup coverage often enough that periodic review is essential.