Every provider backs things up and almost none of them is asked to prove a restore. That gap is where the entire value of the service sits, because a backup is a cost until the day it is a recovery, and on that day the only things that matter are how far back you can go, how long it takes to come back, and whether anybody has ever actually done it. All three are answerable in advance, in writing, and rarely are.
The two numbers data backup and disaster recovery services should commit to
How much work you can afford to lose, and how long you can afford to be down. The first sets how often backups run; the second sets how they are stored and therefore what they cost, because restoring from cold storage is cheap to keep and slow to use. Write both numbers down before asking for quotes, then ask each provider what design meets them and what it costs. Without those two numbers every backup quote is comparable only on price.
Backup retention best practices: what a policy has to decide
How far back you can go and how granular it is at each distance: daily for a few weeks, weekly for some months, monthly for some years is a common shape. It also has to decide what is deliberately not kept, which matters as much, because retaining everything forever is both expensive and a liability where privacy rules apply. Where a regulator or a contract sets a minimum period, that period is the floor and the policy should name it rather than exceed it by accident.
Managed cloud backup: cloud services are not backed up by being in the cloud
A hosted mailbox or file store protects you against the provider losing your data, which is not the thing that happens. What happens is somebody deletes a folder, an account is compromised and files are encrypted, or a leaver's mailbox is removed before somebody needed it. Native retention windows are short and vary by service. Ask specifically whether your cloud tenant is backed up separately, where those backups live and how far back they go.
The test that settles managed backup and disaster recovery
Ask to see a restore test report: a named provider restoring real data on a stated date, how long it took, and what did not work first time, because something always does not. A provider that performs this quarterly and writes it down is selling a recovery service. One that reports successful backup jobs is selling a backup job, and the difference between the two is only discovered on the worst day of the year.
Questions people ask about managed backups
What is backup retention policy best practice for how long backups are kept?
A common shape is daily for weeks, weekly for months, monthly for years. Where a rule sets a minimum, name it in the policy rather than retaining everything by default.
Is cloud email backed up automatically?
Not in the way people assume. Native retention is short and varies by service, and it does not protect against deletion or a compromised account.
How often should a restore be tested?
Quarterly, with a written result naming what was restored, how long it took and what failed first time. Ask to see a redacted example before signing.
What is the difference between backup and disaster recovery?
Backup is having the data. Disaster recovery is being able to work again within a stated time, which usually needs somewhere to run and a plan, not just copies.