Backup For
Independent Insurance Agencies

The files an independent agency cannot afford to lose

Insurance agencies accumulate files that are, in practice, irreplaceable. Many of these documents exist as a single scanned copy on a local hard drive. The following categories represent what a working agency should be able to recover, from a specific date, when the situation demands it.

• Client policy files including signed applications, declarations pages, certificates of insurance, and endorsement records across all lines of coverage
• ACORD forms completed and submitted for clients, including both the submitted copies and any working drafts with client-supplied information
• Signed client agreements and service authorizations
• Claims documentation: loss notices, adjuster correspondence, settlement records, and claim history for each client
• Commission statements and premium reconciliation records from carriers
• Client correspondence and email records, including coverage conversations that may be the only record of what was discussed or declined
• Agency management system (AMS) local data, exports, and database files maintained by major AMS platforms in your office or on your server
• Scanned identification documents, certificates, and supporting paperwork collected from clients at application
• Agency financial records and accounting data, including QuickBooks or similar accounting software files used for agency revenue tracking
• Marketing materials, proposal templates, and coverage comparison documents built up over years of agency operation
• PST archives and locally stored email for agency staff, which often contain the only complete thread history of client interactions

A gap in any one of these categories can surface at the worst possible time: when a client has an open claim, when a coverage dispute needs documentation, or when a long-standing client's history needs to be reconstructed after a system failure.

Where backup gaps hide in an independent agency

• The AMS treated as the backup. Your agency management system holds critical client and policy data, but the platform storing your data is not the same as an independent backup you control. Whether that data lives locally on your server or in the vendor's cloud, your ability to restore a specific prior version of a record on your own timeline depends on the vendor's policies, not yours. An independent backup gives you a copy that remains accessible regardless of what happens with the AMS vendor relationship.
• OneDrive or Dropbox sync mistaken for backup. Cloud sync mirrors whatever is currently on your device. If a file is deleted or overwritten, that change propagates to the synced copy, often within seconds. Ransomware that encrypts local files will encrypt the synced copy before the sync service has any chance to detect it. Sync and backup are not the same protection. See cloud sync vs. backup for a complete comparison.
• Local scans on a single workstation. Many agencies scan client documents directly to a desktop or laptop that is not part of any backup scope. The front desk PC, the producer's laptop, and the agency principal's machine each represent separate coverage questions. If any one of those machines fails, the files on it are gone unless they are explicitly included in a backup that runs to a separate location.
• PST email archives excluded from backup. Outlook PST files are large, frequently locked while Outlook is open, and often omitted from backup configurations for exactly those reasons. Yet those archives may contain years of client communications that would be needed to reconstruct a coverage conversation or document what a client was told.
• No tested restore process. A backup job completing without errors tells you that data was transferred. It does not tell you whether the files are intact, complete, or retrievable in the format you need. Many agencies discover gaps only at the moment a specific file is needed from a specific date. At that point, the gap cannot be filled retroactively.
• Staff turnover removing institutional backup knowledge. When the one person who set up the agency's backup leaves, the knowledge of what folders are covered, where backup data goes, and how to initiate a restore often leaves with them. The backup may continue running, or it may have stopped without anyone knowing.
• Backup media stored in the same building. An external hard drive kept next to the server it is backing up provides no protection against fire, theft, or flooding. The 3-2-1 principle established by CISA calls for at least one copy stored off-site, in a separate physical location from the primary data.

Understanding the 3-2-1 backup rule for agency files

The 3-2-1 rule is a straightforward framework promoted by CISA and widely used in small-business backup guidance. For an independent insurance agency, here is what it looks like in practice.

A backup standard for small insurance agencies

The checklist below reflects CISA small-business backup principles and FTC small-business cybersecurity guidance, applied to the practical file environment of an independent agency. This is a starting framework for backup decisions, not regulatory, legal, or compliance advice. Any obligations your agency has to clients, carriers, or state regulators are separate and should be determined with qualified advisors.

• Include every machine that holds agency files. Start by listing every Windows computer in the agency, including the front desk, producer workstations, the agency principal's machine, and any shared server. For each one, ask what files live locally on that machine that are not copied anywhere else. That list defines your minimum backup scope.
• Make sure AMS local data and exports are in scope. Your agency management system may keep a local database or generate regular exports. Whether that data lives on a local server or a workstation, it needs to be included in your backup scope explicitly. Do not assume the AMS vendor is providing an independent backup that you control.
• Retain enough version history to catch delayed discovery. CISA guidance notes that ransomware and accidental deletions are often not discovered for days or weeks. A backup window of only 24 to 48 hours may not let you recover a clean version of affected files. Backup retention of at least 30 days of version history gives you a meaningful window to detect and recover from incidents that were not noticed immediately.
• Encrypt backup data in transit and at rest. Client policy files, personal information collected at application, and financial records require confidential handling. Backup data should be encrypted before it leaves your environment and should remain encrypted in storage, so that a breach of the backup destination does not expose client information.
• Monitor backups and receive alerts on failures. A backup job that fails silently leaves you with no current coverage and no warning. Monitoring that sends an alert when a backup job fails, misses its schedule, or produces errors is a baseline requirement. Discovering a months-long backup gap only when you need to restore is a situation that monitoring is designed to prevent.
• Test restores on a regular schedule. CISA explicitly recommends periodic restore testing to verify that backups produce usable files. For a small agency, a quarterly spot-restore is a reasonable starting cadence: pick a handful of files from different machines and different backup dates and confirm you can retrieve them in full and open them. This surfaces scope gaps, file-format issues, and process gaps before a real recovery event.
• Document who handles recovery and what the priorities are. Someone in the agency should know the answers to three questions: what is backed up, where does the backup data go, and how do you start a restore. A short written note with those answers, kept somewhere other than the machine being backed up, is the difference between a manageable recovery and a chaotic one.

For additional context, see the small-business backup checklist, and for ransomware-specific preparation guidance, see ransomware restore readiness.

Agency management systems and QuickBooks: what backup actually covers

Two categories of software generate the bulk of an independent agency's critical data: the agency management system and the accounting platform. Understanding what your backup does and does not cover for each is important.

Ransomware and the independent agency

The FTC and CISA both publish guidance specifically noting that small businesses, including professional services firms with client records, are targets of ransomware campaigns. The reason is practical: small businesses often have less IT infrastructure than large corporations, which makes them easier to compromise, while still holding valuable client information that creates pressure to pay.

For an independent insurance agency, the combination of factors that makes ransomware consequential includes: all client files concentrated on a small number of Windows machines, reliance on a single AMS installation for client and policy data, and typically no dedicated IT staff monitoring backup health daily.

CISA's #StopRansomware guidance identifies offline and encrypted backup copies as the primary technical recovery mechanism when ransomware has encrypted production files. The critical point is that a backup connected to the same network as the infected machines, or a cloud sync folder that replicates in real time, may itself be encrypted before the attack is detected. A backup that is not continuously connected to your network is the copy most likely to survive a ransomware event intact.

For a structured look at what a ransomware-capable backup posture looks like for a small office, see ransomware restore readiness.