BACKUP & DISASTER RECOVERY
Your data is your business. We design, implement and manage backup strategies that protect it, with tested recovery plans so you know exactly what happens when something goes wrong.
Most businesses assume their data is protected. The reality is different. Cloud providers like Microsoft operate on a shared responsibility model, which means your data is your responsibility to back up.
Even for a micro business with 1-20 employees, IT downtime costs an average of $8,000 per hour. For small businesses (21-99 staff), that jumps to $50,000 per hour. These are not worst-case scenarios. They are averages across the ITIC survey of over 1,800 organisations. The figures account for lost employee productivity across every affected staff member, interrupted revenue and sales, emergency remediation, and downstream customer impact. They do not include legal penalties, compliance fines, or litigation costs, which push the real number higher.
Organisations with tested backup and disaster recovery plans recover 96% of their data on average, compared to just 57% with untested backups and 12% with no plan at all. Testing your backups is not a nice-to-have. It is the difference between a disruption and a catastrophe.
Source: Veeam 2025 Ransomware Trends, IBM Cost of a Data Breach 2024
Microsoft, Google and other cloud providers are responsible for platform uptime, not for protecting your data.
A team member deletes a SharePoint library or an email folder. Microsoft’s recycle bin retention is limited, and once it expires, that data is gone. Without an independent backup, there is no recovery path.
88% of SMB breaches involve ransomware. If your production data and your backups live in the same environment, both get encrypted. Cloud-to-cloud backup with independent storage is your insurance policy against paying a ransom.
When a Microsoft 365 account is deleted, the associated mailbox, OneDrive and Teams data follow a retention countdown. If you need that data six months later for a legal matter or compliance audit, it may already be permanently removed.
Microsoft’s built-in retention policies are designed for compliance, not backup. They have limits, require configuration, and do not provide point-in-time restore. A proper backup gives you independent control over how long data is kept and how fast it can be restored.
We tailor backup scope to your environment. Whether your business runs entirely in the cloud, has on-premises infrastructure, or a mix of both, we have a solution that fits.
Backup is not a product you install. It is a strategy that needs to match your business requirements. We work with you to define the right approach based on what actually matters to your operations.
Every business has different data, different compliance obligations, and different tolerance for downtime. We start by understanding your retention requirements, your recovery time objectives (RTOs), and your recovery point objectives (RPOs). This determines the backup strategy, not the other way around.
For businesses that need it, whether for compliance, insurance, or good governance, we help define or work within a business continuity plan (BCP) as it relates to your IT environment. This covers how your business keeps operating during a disruption, including who is responsible for what, communication plans, and critical system priorities.
A disaster recovery plan (DRP) is the technical counterpart to your BCP. It documents exactly how systems are restored, in what order, and within what timeframes. We help build and maintain this based on your actual infrastructure, whether that is Microsoft 365, Azure, on-premises servers, or a combination.
If your backups live on the same network as your production data, or in the same cloud region as your primary systems, you have a single point of failure. We design backup architectures that store copies independently, whether that is cloud-to-cloud, on-prem-to-cloud, or cross-region replication.
A backup you have never tested is a backup you cannot trust. We schedule regular restore tests to verify that backups are complete, recoverable, and meet your RTO. Testing also identifies gaps before they become problems during an actual incident.
Backups are monitored daily for failures, warnings, and anomalies. You receive regular reporting on backup health, storage consumption, and any actions taken. If something fails, we know about it before you do, and we fix it.
Not all backups serve the same function. The right solution depends on why you need it and what you need to recover from.
Some industries require data to be kept for 5, 7, or 10+ years. We configure long-term retention policies with immutable storage options, ensuring you meet regulatory and insurance requirements without relying on native platform retention alone.
If your business cannot afford hours of downtime, we design for rapid recovery. This might mean Azure VM snapshots that restore in minutes, or standby infrastructure that can be activated during an outage. The faster you need to be back online, the more deliberate the architecture needs to be.
Recovery point objectives determine how much data you can afford to lose. A daily backup means up to 24 hours of data loss in a worst case. If that is not acceptable, we implement more frequent backup schedules or near-continuous data protection for critical systems.
For businesses where any single failure could be catastrophic, we build redundancy into the backup architecture itself. This includes storing backups across multiple locations, using different vendors, and ensuring no single event (a fire, a ransomware attack, a provider outage) takes out both production and backup systems.
Most businesses assume Microsoft handles their backups. They do not. Microsoft’s Service Agreement explicitly recommends that you “regularly back up your content and data that you store on the services or store using third-party apps and services.”
Microsoft is responsible for platform availability, infrastructure security, and data centre resilience. You are responsible for your data. That includes protection against accidental deletion, malicious insiders, ransomware, and retention beyond Microsoft’s default policies.
This is not a gap in Microsoft’s service. It is a deliberate shared responsibility model, and it applies to Exchange, SharePoint, OneDrive, Teams and every other M365 service. If your business relies on Microsoft 365, independent backup is not optional.
| Microsoft’s responsibility | Your responsibility |
|---|---|
| Platform uptime and availability | Data protection and backup |
| Infrastructure security | Retention and compliance |
| Data centre resilience | Ransomware recovery |
| Service-level replication | Accidental deletion recovery |
| Geo-redundant infrastructure | Point-in-time restore |
No. Microsoft provides platform-level resilience (their data centres will not lose your data due to their infrastructure failing), but they do not provide backup in the traditional sense. Accidental deletion, ransomware, malicious insiders, and retention beyond their default policies are all your responsibility. Microsoft’s own Service Agreement recommends using a third-party backup solution.
Business continuity planning (BCP) focuses on keeping your business operating during a disruption. It covers processes, people and communication. Disaster recovery (DR) is the technical component, specifically how IT systems and data are restored. Both work together, and a good backup strategy is central to your disaster recovery plan.
At minimum, quarterly. For critical systems, monthly. We schedule regular restore tests and provide documentation of the results. A backup that has never been tested is not a backup you can rely on, and many businesses discover their backups are incomplete only during an actual incident.
Recovery Time Objective (RTO) is how long you can afford to be offline. If your RTO is 4 hours, your systems need to be back up within 4 hours of an incident. Recovery Point Objective (RPO) is how much data you can afford to lose. If your RPO is 1 hour, your backups need to run at least every hour. These two numbers drive your backup architecture and cost.
It depends on your industry and obligations. Some industries (healthcare, legal, finance, government contractors) require formal BCPs for compliance. Cyber insurance providers also increasingly require documented DR plans. Even if it is not mandated, having a documented plan means your team knows exactly what to do when something goes wrong, rather than figuring it out under pressure.
Yes. We provide cloud off-site backup for on-premises servers and workstations. Data is encrypted and stored in Australian data centres, giving you geographic separation from your primary site. This removes the risk of a single event (fire, flood, theft) affecting both your production systems and your backups.
If your backup is independent and immutable, we can restore your systems without paying a ransom. This is why backup architecture matters. If your backups are stored on the same network or in the same tenant as your production data, ransomware can encrypt those too. We design backup solutions that are isolated from your production environment specifically for this reason.
Cost depends on the scope (what you are backing up), the volume of data, the retention period, and the recovery objectives. Microsoft 365 SaaS backup for a typical SMB is straightforward and cost-effective. More complex environments with Azure VMs, on-premises infrastructure, or strict compliance requirements will vary. We will give you honest pricing based on your actual needs.
Talk to our team about your current backup situation. We will review what you have, identify gaps, and recommend a strategy that matches your business requirements, your compliance obligations, and your budget.
