How often you back up their data: This sets the initial expectation of your RPO. If your system can back up as often as every 15 minutes, make sure you have a clause that defines that this is dependent upon the server’s ability to be backed up that often. I have seen cases where the server was very over taxed and could only be backed up once a day, even though the agent allowed a 15-minute solution.

How often you get the data off site: Even though your solution takes the “offsite” copy as of midnight, the actual data may not get off site until a day or so later. Define your offsite restore based upon the files your remote system has received. (See my second blog on automatic off-siting of data).

Define what your backup solution might skip: This might seem weird, but if your backup solution is file-based and is only allowed to back up certain files based upon the backup agent’s administration rights, if someone comes along and changes those rights (the over-zealous security administrator, for example), it could change what you are backing up instantly.

Beware the anti-virus: So, what has anti-virus got to do with anything? Well, most backup agents look like viruses, so you will want to define that any anti-virus software applied to the server or workstation should exclude your backup agent files and temp directories from any scan.

Define administrative stoppages: This section simply states that you are not responsible for backing up their servers if your backup process is in any way tampered with or paused.