Protect
We design and implement backups covering your critical systems and data.
Managed Cloud
Business Continuity & Disaster Recovery
Tested backups and recovery plans that keep your business running when the unexpected happens.
Overview
Be ready for when, not if
Hardware fails, mistakes happen and ransomware is real. The businesses that recover quickly are the ones that planned and tested beforehand.
WhizzIT designs, implements and, crucially, tests your backup and disaster recovery, so you can recover fast with confidence. Untested backups are one of the most common gaps we find.
Back to Managed Cloud ServicesWhat's included
- Backup design and implementation
- Regular, tested recovery
- Recovery time and recovery point objectives
- Ransomware-resilient backups
- Cloud and on-premises coverage
- Documented, rehearsed recovery plans
The two numbers
Two numbers decide everything
Before any of the technology matters, two questions need answering, and they are business questions rather than IT ones.
How much work can you afford to lose? That is your recovery point objective. If backups run nightly, your RPO is up to 24 hours, which means a failure at four in the afternoon costs you the whole day. For a finance team mid month that might be genuinely serious. For other work it is an annoyance. Only you can say which.
How long can you be down? That is your recovery time objective. Restoring a large fileserver from cloud storage is not quick, and if the honest answer is two days while the business needs four hours, no amount of backup software fixes that. The design has to change instead, usually towards replication or standby systems for the handful of things that genuinely cannot wait.
Get those two numbers agreed and everything else follows from them. Skip them and you end up with backups that technically exist and a recovery that takes a week, which is the situation most businesses are quietly in.
What we agree with you
- Recovery point objective, per system
- Recovery time objective, per system
- What is genuinely critical and what can wait
- Who does what during an incident
- How often recovery is tested
- Where the documentation lives when systems are down
Ransomware
How ransomware targets backups
Your backup is a target, not a safety net
Ransomware crews worked out years ago that encrypting live data is only half a job. If the victim can restore, they do not pay. So the backups get attacked first, and the tools people rely on most are the ones sitting on the same network with the same administrator credentials.
At least one copy has to be somewhere the attacker cannot touch. Immutable storage that cannot be altered or deleted for a set period, separate credentials that are not the ones your domain admin uses daily, and multi-factor authentication on the backup console itself. The old three copies, two media, one offsite rule still holds up, with the modern addition that one copy should be genuinely unchangeable.
Attackers commonly sit inside a network for weeks before triggering anything. If your retention is short, your clean restore point may already have been deleted by the time you need it. Retention is a security decision, not just a storage cost.
The gap almost everyone has
Microsoft 365 backup
Microsoft 365 is not backing up your data
This one catches out well-run businesses regularly. Microsoft keeps your service running and protects its own infrastructure. It does not keep a point-in-time copy of your data for you to roll back to, and its own shared responsibility model says so plainly.
Retention policies, litigation hold and the recycle bin help within limited windows, and none of them give you what you actually want at the worst moment, which is the ability to say put this mailbox, or this SharePoint site, back exactly as it was on Tuesday morning. Deleted items age out. A user with permissions can destroy a lot of shared content quickly, and ransomware syncing through OneDrive will happily do the same.
The fix is unglamorous and cheap relative to the risk: an independent backup of Microsoft 365 or Google Workspace, held separately from the platform itself, with retention you have actually chosen rather than inherited.
Certified & accredited
Credentials you can check
Cyber Essentials certified
Independently assessed against the UK government-backed scheme, so our security fundamentals are verified rather than simply claimed. We help clients certify too.
How Cyber Essentials helps you
Microsoft Cloud Solution Provider
A direct partnership with Microsoft. We license, deploy and support Microsoft 365 and Azure for you, with escalation straight to Microsoft when it is needed.
Our Microsoft cloud servicesCyber Essentials is a UK government scheme run by the National Cyber Security Centre, delivered by IASME. You can verify what the certification covers at source.
No obligation
Not sure where to start?
Tell us the problem and we will point you to the right fix, even if that turns out not to be us.
Tommy Sabine, Director, Codeshield · see all 15 reviewsGreat IT support company. The WhizzIT team are professional, responsive and easy to work with. Any issues are dealt with quickly and they are never slow to pick up the phone.
How we help
What we deliver
Test
We regularly test recovery, so your backups actually work when it matters.
Recover
When something goes wrong, we get you back up and running fast.
Good to know
Frequently asked questions
Because an untested backup is a hope rather than a plan, and the failure modes are boring. A job that has been silently erroring for months. A new system nobody added. A restore that works but takes three days when the business needed four hours. Testing recovery is what turns a backup into something you can rely on.
Recovery time objective is how long you can be down. Recovery point objective is how much work you can afford to lose. If backups run nightly, your RPO is up to 24 hours. Both are business decisions rather than technical ones, and every sensible design starts by agreeing them per system.
That is the design goal, and it means more than offsite. At least one copy is held immutably so it cannot be altered or deleted within its retention window, backup credentials are separate from everyday administrator accounts, and the backup console itself is behind multi-factor authentication. Retention is set long enough that a clean restore point still exists, since attackers often wait weeks before triggering anything.
No, and this is one of the most common misunderstandings we run into. Microsoft protects the platform and keeps the service available. Retention policies and the recycle bin help inside limited windows, but none of it gives you a point-in-time restore of a mailbox or a SharePoint site. That needs an independent backup held outside the platform.
On an agreed schedule rather than whenever there is a spare afternoon, and the test is an actual restore rather than a green tick in a console. We also rehearse the human side, because during a real incident the questions are who calls whom, in what order, and where the documentation is kept when the systems holding it are the ones that are down.
Critical systems and data across cloud and on-premises, including Microsoft 365 and Google Workspace, servers, and the line-of-business applications that usually turn out to matter more than anyone expected. Coverage follows the recovery objectives you have agreed rather than a one-size package.
Technology partners
Brands we partner with
We hold partner status with the vendors behind the tools we deploy, so your licensing, support and escalation come direct from the source rather than through a reseller chain.
Ready when you are
Interested in business continuity & disaster recovery?
Book a free consultation and we'll tailor it to your business.