Backup and recovery

A backup only counts if you have restored from it.

Most offices have some kind of backup. Far fewer know how long a full restore takes, whether the backup covers cloud mailboxes, or whether an attacker with admin access could delete it. We design for the day you need it and prove it with tests.

Section 1

Threat Briefing

In the Sophos 2025 survey, data was encrypted in 50% of ransomware attacks, and in 28% of those the attackers also stole data. (Sophos)

Backups were used to recover data in only 54% of cases, a six-year low, and 49% of victims whose data was encrypted paid the ransom. The median payment was $1 million against a median demand of $1,324,439. (Sophos)

The mean cost to recover, excluding any ransom, was $1.53 million, and 53% of organizations were fully recovered within a week. The survey covered 3,400 organizations of 100 to 5,000 employees in 17 countries, so smaller offices should read the dollar figures as direction, not a quote. (Sophos)

CISA recommends offline, encrypted backups that are tested regularly. (CISA #StopRansomware Guide) A proposed HIPAA Security Rule update would require the ability to restore critical systems within 72 hours; it is still a proposal. (Federal Register NPRM)

Section 2

Risk and Compliance Matrix

Exposure	Framework or rule it maps to	What it costs you
Backups reachable with the same admin password as production	CISA #StopRansomware Guide; NIST CSF 2.0 PR.DS	Attackers delete backups before encrypting, leaving ransom as the only option
Cloud mail and files not backed up	NIST SP 800-34 contingency planning; HIPAA 45 CFR 164.308(a)(7) contingency plan	Deleted or encrypted mailboxes and shared drives with no independent copy
Restores never tested or timed	HIPAA 164.308(a)(7)(ii)(D) testing and revision; NIST SP 800-34	Downtime measured in weeks instead of hours
No written recovery order or targets	NIST CSF 2.0 RC.RP recovery planning	Staff idle while systems come back in the wrong order

Section 3

Architecture and Remediation Directives

Keep at least three copies on two kinds of storage, with one copy immutable or offline for a set retention period.
Use separate credentials with MFA for the backup console, not your domain or tenant admin accounts.
Back up Microsoft 365 or Google Workspace mail, OneDrive or Drive and shared sites independently of the provider’s own recycle bin.
Write down the recovery order and targets: how much data you can afford to lose (RPO) and how long each system can be down (RTO).
Run a restore test every quarter: one file, one mailbox and one full machine. Record the time taken and fix anything that missed target.
Monitor every backup job in Ares RMM and treat a failed job as a ticket, not a log entry.

Section 4

Vendor-Neutral Verification Checklist

Three tests that work against any provider, including us. Run them before you sign anything.

Pick a file from last month and a whole computer, and ask for both to be restored while you time it. Compare the result with what you would accept during an outage.
Ask which account can delete backups. If it is the same administrator account that manages your PCs or email, one stolen password removes both.
Delete a test email and a test file in your cloud account, empty the recycle bin, and then ask for them back from backup.

FAQ

Frequently asked questions

Microsoft and Google already keep our data. Why back it up?

Their job is keeping the service running. Deleted items, ransomware-encrypted files and a departed employee’s mailbox can still be lost after retention runs out. A separate backup is your copy.

How often do you test restores?

On a schedule set in your plan, and after any major change. Each test records what was restored and how long it took, and the results appear in your portal and monthly report.

What does immutable mean?

It means the backup copy cannot be changed or deleted for a set period, even by an administrator account. That protects you if an attacker gets admin access.

How long would it take to get back up after a disaster?

It depends on what fails and how much data you have. We measure it during restore tests and write the real number into your continuity plan instead of guessing.

Can backups be stored in our country?

Yes. We choose storage regions to match your privacy rules and client contracts.

How we package it