Business Continuity & Disaster Recovery
Business Continuity & Disaster Recovery
When systems go down, every minute costs money, trust, and productivity. GCIT’s BCP/DR framework covers backup management, recovery testing, RTO/RPO documentation, and ransomware-resilient cloud backup for Microsoft 365, Azure, and on-premises infrastructure.
ISO 27001 certified. ISO 9001 quality managed.
Why It Matters
The difference between a ransom paid and a clean recovery is a tested backup.
A Gold Coast manufacturing business was hit by ransomware during their Christmas shutdown. The ransom demand would have been well into six figures. But because they had tested, accessible backups, they restored their systems without paying. The business was back online before staff returned in January.
That’s the outcome when backups are managed properly. The alternative, businesses without tested backups or with backup jobs that silently failed weeks ago, is either paying the ransom or losing everything.
The ASD Cyber Threat Report estimates ransomware downtime at 6 to 21 days for businesses without adequate recovery plans.
What we protect
Microsoft 365 data
Exchange, SharePoint, OneDrive, and Teams. Microsoft does not back up your data for you.
On-premises servers
Physical and virtual servers with cloud replication for offsite redundancy
Azure workloads
Azure VMs, Azure Files, and cloud-hosted applications
Endpoint configurations
Intune policies, Autopilot profiles, and security baselines for rapid device rebuild
Our Approach
Backup is not the same as disaster recovery
Having a backup is step one. Knowing you can actually restore from it, how long it takes, and what you lose in between, that’s disaster recovery. GCIT documents RTO (recovery time objective) and RPO (recovery point objective) for every critical system, and we run regular recovery drills to verify it works.
One of our clients discovered this the hard way. A folder of critical data had been slowly corrupted over months, but by the time they noticed, their backup retention was only two to three weeks. We’re now extending retention to up to 12 months for clients, so you can recover from problems that aren’t discovered immediately.
“We document RTO and RPO targets, run regular recovery drills, and maintain immutable backups that can’t be encrypted by ransomware. When an incident occurs, recovery is not a scramble. It’s a documented, tested process.”
Elliot Munro
CISO, GCIT
RTO and RPO documentation+
Every critical system gets a documented recovery time objective (how long until it’s back) and recovery point objective (how much data you lose). These targets inform backup frequency, retention policies, and recovery priorities during an incident.
Regular recovery testing+
Backups that haven’t been tested are assumptions, not guarantees. We run regular recovery drills to verify that data can be restored, systems come back online, and the documented RTO is achievable. Results are reported and any gaps are addressed immediately.
Immutable and offsite backups+
Ransomware specifically targets backup files. We maintain immutable backups that cannot be encrypted, deleted, or modified by an attacker, even if they gain administrative access to your environment. Backups are replicated offsite to geographically separate locations.
Microsoft 365 backup+
Microsoft’s native retention is limited and not a backup. We provide independent backup of Exchange Online, SharePoint, OneDrive, and Teams data with granular restore capabilities. You can recover individual emails, files, or entire mailboxes without waiting for Microsoft support.
Extended retention (up to 12 months)+
Standard two to three week retention isn’t enough for problems discovered weeks or months later, like corrupted data, accidental deletions, or compliance investigations. We’re extending retention options to up to 12 months, giving you a much wider recovery window.
Business continuity planning+
Beyond technical recovery, we help you plan for operational continuity: who does what when systems are down, how staff communicate, where they work from, and what the priority order is for bringing services back online. This connects directly to our incident response framework.
Recovery Scenarios
What recovery looks like for different failures
Every disaster is different. Here’s how our framework handles the most common scenarios.
Ransomware
Encrypted files across the network
Contain the attack, isolate affected systems, verify backup integrity, restore from immutable backups. Devices wiped and rebuilt via Intune. No ransom paid.
Server Failure
On-premises server goes down
Restore from the latest cloud-replicated backup to replacement hardware or spin up a temporary Azure VM. Critical services restored within RTO targets.
Accidental Deletion
Critical files or mailboxes deleted
Granular restore from M365 backup: individual emails, files, folders, or entire mailboxes. No need to restore an entire system for a single file.
Power Outage
Multi-site infrastructure down
Remote triage via ScreenConnect and RMM. Check server status across all sites, verify backup integrity, coordinate ISP restoration, and confirm services are back online.
Data Corruption
Gradual corruption over weeks
Extended retention (up to 12 months) means you can roll back to a clean version even if the problem wasn’t detected for weeks. Standard 2-week retention would have made this unrecoverable.
Office Inaccessible
Flood, fire, or facility lockout
Cloud-first architecture means staff can work from anywhere with a laptop and internet. M365 data is in the cloud, Intune policies follow the device, and VPN or Azure Virtual Desktop provides access to line-of-business apps.
Integrated Protection
DR connects to everything else we do
Disaster recovery doesn’t exist in isolation. It connects to incident response (how we contain and recover), managed cybersecurity (how we prevent the disaster in the first place), and service level agreements (how quickly we commit to restoring operations).
Every GCIT managed service plan includes backup management, monitoring, and recovery support. Backup health is reported monthly as part of your operational reporting, alongside security posture and service performance.
300+
Organisations protected
12 mo
Extended retention
Tested
Regular recovery drills
ISO 27001
Certified processes
Your monthly IT report
Backup in your report, stated honestly
Your monthly IT report shows what your agreement includes and, where we manage your server backups through our backup platform, the evidence from those backups.
- Server backups: where we manage your server backups through our backup platform, the last backup jobs, restore points, and whether an offsite or immutable copy exists.
- Backup & recovery in your agreement: for agreements on our current plans, marked included or not included alongside the other baseline controls.
- Plain about limits: the report’s own guide says a successful backup job does not replace a restore test.
- About the data: every source, when it was last refreshed and whether it worked.
Server backup reporting depends on the services in your agreement.
Common Questions
Frequently asked questions
Does Microsoft back up my Microsoft 365 data?+
No. Microsoft provides infrastructure resilience (their data centres are redundant) but they do not provide backup of your data. If an email is deleted, a SharePoint site is corrupted, or a mailbox is compromised, Microsoft’s retention policies are limited and time-bound. You need independent backup to guarantee recovery.
What is the difference between RTO and RPO?+
RTO (recovery time objective) is how long it takes to restore a system after a failure. RPO (recovery point objective) is how much data you can afford to lose, measured in time since the last backup. For example, an RPO of 4 hours means you could lose up to 4 hours of data. We document both for every critical system and design backup schedules to meet them.
How do you protect backups from ransomware?+
We use immutable backup storage that cannot be encrypted, deleted, or modified, even by an administrator account. Backups are replicated to geographically separate cloud storage. This means even if an attacker gains full access to your environment, the backup data remains intact and recoverable.
How often do you test backups?+
We run regular recovery drills and report results. Backup job health is monitored daily and any failures are investigated immediately. Successful backup verification is included in your monthly operational reports. We don’t just check that the backup ran. We verify that the data can be restored.
Is backup included in your managed service plans?+
Backup management, monitoring, and recovery support are included in every GCIT managed service plan. Backup storage costs are based on data volume and retention requirements, and are clearly itemised so you can see exactly what you’re paying for.
What happens if our office is inaccessible?+
For cloud-first environments (which most of our clients run), staff can work from any location with a laptop and internet. Microsoft 365 data is in the cloud, Intune policies follow the device, and Azure Virtual Desktop can provide access to line-of-business applications that normally run on-premises. We help plan for this as part of your business continuity framework.
Reviewed by Elliot Munro, CISO at GCIT
Can your business recover from a disaster today?
If you’re not sure whether your backups are tested, your retention is adequate, or your recovery plan is documented, talk to us. We’ll assess your current DR posture and show you where the gaps are.