Do OneDrive or Google Drive Count as Cyber Insurance Backup?

There is no universal cyber insurance backup answer for OneDrive or Google Drive, because it depends on the form. At-Bay's June 2026 application lists cloud sync (Google Drive, OneDrive, SharePoint) as a separate storage description from a dedicated cloud-based backup service. If ordinary sync is all you run, disclose it as sync and do not relabel it. Other carriers can word this differently, so read your exact form and ask the broker or carrier to clarify undefined terms.

What does the At-Bay application actually ask?

It asks several separate backup questions, and only one of them names cloud sync. That question treats sync and a dedicated backup service as different descriptions of how backup copies are stored, without defining either term.

The At-Bay application covers this in its Backups & Recovery section:

• Q13 (yes/no): whether the applicant has "procedures and tools in place to back up and restore sensitive data and critical systems."
• Q14 (yes/no): whether it keeps "offline backups that are disconnected from its network or store backups with a cloud service provider."
• Q15 (select all that apply, optional): how backup copies are stored. Options include "Cloud sync (e.g. Google Drive, Microsoft OneDrive, Microsoft SharePoint)" and "Dedicated cloud-based backup service (e.g. Acronis, Veeam, CrashPlan)". It also asks for backup vendor names.
• Q16 (yes/no/unknown, optional): whether "all critical backup copies" are immutable, meaning they "cannot be modified or deleted within their retention window."

The form does not call sync worthless, since sync appears as an answer about backup copies, but it keeps sync and a dedicated service apart. Whether sync alone supports a Yes on Q13 or Q14 is not stated, so ask.

Question 27 of the October 2026 Societies Insurance supplemental application asks: "Are backups kept offline or immutable, and tested at least twice a year?" It is one Yes/No and does not mention sync. These are two real forms, not an industry standard.

When is cloud sync not enough to call a backup?

It falls short when you cannot show a copy that survives damage to the live files. A synchronized copy is not automatically independent, offline, immutable, separately administered or restore-tested, so each of those needs its own evidence.

Document those facts separately with the companion guides to backup restore-test evidence and offline, isolated and immutable backup evidence.

Vendor vocabulary will not settle this. Microsoft's folder backup page says "When your files finish syncing to OneDrive, they're backed up." That is product language, and it does not decide which box applies on a carrier's form.

Q13 also covers "critical systems," and a synced document library does not by itself restore a server, a database or a line-of-business application.

General security guidance, which is not carrier wording, points the same way. The CISA #StopRansomware Guide recommends offline, encrypted backups of critical data with regular testing, because many ransomware variants try to find and delete or encrypt accessible backups.

Can version history and recycle bins help?

Yes, they can contribute to recovery. Their reach varies by platform, plan, administrator settings, item type and time window, so document what your tenant actually does before describing it on a form.

These figures are what vendor pages said in November 2026, each for its stated scope:

• OneDrive version history: Microsoft states that history "is retained for 30 days" and that a work or school administrator "may have turned off document versioning."
• Restore your OneDrive: this Microsoft 365 feature can undo actions from the last 30 days. A file permanently deleted from the OneDrive Recycle Bin cannot be recovered.
• Google Drive trash and versions: files stay in Trash for 30 days. A version of an uploaded file "might be permanently deleted after 30 days or if there are 100 newer versions" unless marked Keep forever. Docs, Sheets and Slides use a different history.
• Google bulk and admin restore: the Restore file versions tool was labeled Beta, and its page says Drive keeps the last 25 days of revisions. An admin can restore items within 25 days after a user empties their trash, by date range rather than by individual file.

Record these on the application as recovery features, not as a separate backup copy.

What if a separate service backs up Microsoft 365 or Google Workspace?

Then describe that service as what it is and name it, because a dedicated backup is a different fact from the sync underneath it. Confirm which workloads it protects, who administers it, whether its copies are immutable and when a restore last succeeded.

Microsoft 365 Backup is a separate pay-as-you-go offering for selected SharePoint sites, OneDrive accounts and Exchange mailboxes. Check three details before answering:

• Location: the data "never leaves the Microsoft 365 data trust boundary," so do not describe it as offline or outside Microsoft 365.
• Immutability: Microsoft says its append-only storage follows the formal definition "except for disallowing deletion," with a 90-day grace period after offboarding. Compare that with At-Bay's "modified or deleted" wording and ask the broker how to answer Q16.
• Restore age: file and folder restores are limited to recovery points within the most recent 14 days. Older points support full site or account restores.

Google's Vault FAQ says "Vault isn't designed to be a backup or archive tool" and points to Data Export, APIs and partner products. The Data Export page describes exporting and downloading an archive, deleted after 60 days by default, and does not describe restoring it into Workspace.

If a provider runs the backup, CISA says to ensure the provider follows the same practices and to formalize that in the contract.

What evidence should back the answer?

Keep one dated record per environment so the signer can trace each answer to something real:

• Data and workloads in scope: files, mailboxes, servers, databases, SaaS.
• Sync platform and plan: product and license.
• Separate backup product or provider: name, or "none."
• Independent administrative credentials: who can delete backups, and whether those accounts differ from production admins.
• Offline or immutable copy: where it lives, and the setting or contract term that proves it.
• Retention/configuration evidence: dated exports of the actual settings.
• Restore granularity: file, folder, account, site or full system.
• Last successful restore test: date, scope, who verified it.
• Open exceptions and unprotected workloads: each one, with an owner.

How should you answer in common situations?

These fictional examples use the At-Bay wording. The sample notes organize facts and are not legal language.

Only ordinary cloud sync is in place

Select Cloud sync on Q15 and leave the dedicated service unselected. Answer Q16 from evidence: No or Unknown, unless you can prove the copies are immutable. Ask the broker whether sync supports a Yes on Q13 and Q14 before marking them. Sample note: "Files are in OneDrive and SharePoint with version history as configured [settings]. No separate backup product. Last restore test: [result or none]."

Cloud sync plus a dedicated third-party backup exists

Select both, because both are true, and name the vendor. Answer Q16 only for what you can show about the critical backup copies. Sample note: "[Vendor] backs up [workloads], administered through [separate accounts]. Last restore test: [result]."

Some workloads are backed up but others are not

If the form allows multiple selections, select only the descriptions that are true and use the optional description field to state which workloads each covers. On yes/no questions, do not average away exceptions: Q16 asks about "all" critical backup copies, and Societies Q27 bundles copies and testing into one answer. Clarify scope with the broker or carrier in writing. Societies invites additional sheets if more space is needed. Sample note: "[Workloads] are protected by [product]. [Workloads] are not; [owner] plans to close that by [target]."

What should the signer verify before submitting?

Verify that each answer matches current evidence for the systems in scope, and that exceptions are disclosed. Describe anything not yet live as a plan.

• The exact form wording was read, and undefined terms were clarified in writing.
• Only true descriptions were selected, and vendor names are correct.
• A restore test supports the claim, or its absence is stated.
• Changes before the policy starts will be reported as the form requires.

At-Bay's signer declares, "to the best of their knowledge and belief, after reasonable inquiry," that the statements are true and complete, and the form says misrepresentation, omission or concealment "shall be grounds for the rescission of any Policy issued." Societies has the undersigned warrant that the information is "true and complete as of the date submitted."

No backup configuration guarantees eligibility, a price, coverage, a renewal, a limit or claim payment. This is not legal or insurance advice. The same answer-from-evidence method applies to the MFA section, the EDR question and the patching question.

Sources

• At-Bay Cyber Insurance Application, Ed. 06/2026
• Societies Insurance Supplemental Application, 2026.10.08
• Microsoft: Restore a previous OneDrive file version
• Microsoft: Restore your OneDrive
• Microsoft: Back up your folders with OneDrive
• Microsoft 365 Backup overview
• Restore data in Microsoft 365 Backup
• Google: Recover a deleted Drive file
• Google: Check activity and file versions
• Google: Restore files in bulk
• Google Workspace: Recover deleted Drive files
• Google Vault FAQ
• Google Workspace: Export your organization's data
• CISA #StopRansomware Guide