Why backup and disaster recovery matter
Many businesses assume backup is a solved problem until something goes wrong. In reality, backups are only one part of the picture. The real question is whether critical systems, files and cloud data can be restored within an acceptable timeframe and with an acceptable level of data loss.
That’s where disaster recovery planning becomes critical. The business needs to know what must be recovered first, how long systems can be down, what information matters most and what steps will be taken during an incident.
“Backup completion is not the goal. Recovery is.”
More than just copied data
A strong backup and disaster recovery approach usually involves:
- Identifying critical systems and business data — including what lives in Microsoft 365.
- Defining realistic recovery point (RPO) and recovery time (RTO) objectives.
- Protecting backup repositories from tampering or ransomware.
- Testing restores before a real incident occurs.
- Reviewing whether current backup methods still match the environment.
Without those elements, a business may have backup files but still be unprepared for a serious outage.
Microsoft 365 backup with AvePoint
Microsoft keeps Microsoft 365 running, but under its shared responsibility model your data is yours to protect. Recycle bins and version history help with small mistakes, but retention windows expire, ransomware can sync encrypted files through OneDrive, and a compromised admin account can delete data at scale.
We use AvePoint to keep independent, automated backups of your Microsoft 365 data outside your production tenant.
- Exchange Online
- Mailboxes, calendars and contacts backed up automatically.
- OneDrive
- User files protected, including against ransomware sync.
- SharePoint
- Sites, libraries and lists backed up and restorable.
- Teams
- Team files and conversations protected.
- Granular restore
- Restore one email or file, a whole mailbox or site, or roll back to a point in time.
Where Acronis fits
For devices, servers and business systems outside Microsoft 365, Acronis provides a strong foundation for backup, cyber protection and recovery workflows, with better visibility, more structured retention and stronger recovery confidence. See our Acronis page for more.
Built for ransomware recovery
Ransomware on one laptop can encrypt thousands of synced files in minutes, and attackers increasingly target backups directly. We design backups so an attacker who reaches your live systems can’t reach your copies, and so data can be restored in bulk to a known-good point before the attack.
- Immutable or isolated backup storage with separate credentials.
- Point-in-time restore for files, mailboxes and sites.
- A documented recovery sequence for a ransomware event.
- Regular restore tests to prove it works.
How EduCom IT helps
- Design
- Backup strategy aligned to real systems, real workloads and real recovery expectations.
- RPO / RTO
- Recovery point and recovery time objectives set against the cost of being down.
- Microsoft 365
- Independent AvePoint backup of Exchange Online, OneDrive, SharePoint and Teams.
- Resilience
- Immutable backups and ransomware resilience built into the design.
- Test
- Recovery testing and restore validation — not just success notifications.
- Document
- Practical recovery processes, contacts and decision points written down.
- Review
- Ongoing review as systems, staff and platforms change.
Frameworks it supports
Backup and recovery are core requirements in every major framework. We confirm coverage during a gap review.
- ASD Essentials
- Regular and proven backups, including isolated repositories, restore testing and customer-controlled backup of cloud data and tenant settings.
- CIS v8.1
- Control 11 (data recovery).
- ISO 27001
- Annex A 8.13 (information backup) and 5.30 (ICT readiness for business continuity).
- SMB1001
- Backup and recovery requirements at each tier.
Recovery confidence, not just backup completion
The goal of backup and disaster recovery isn’t simply to store copies of data. It’s to give your business a realistic path back to operations when something goes wrong. We build that confidence through better planning, stronger tooling and a practical approach to business continuity.
Frequently asked questions
What is the difference between backup and disaster recovery?
Backup is the copy of the data. Disaster recovery is the plan and process for getting the business operating again after an incident. You need both — copies of files don’t help if no one knows what to bring back first.
What are RPO and RTO?
Recovery Point Objective is how much data loss you can tolerate (for example, an hour of work). Recovery Time Objective is how long you can be down. They drive the design — how often backups run, where they’re stored and how recovery is sequenced.
Does Microsoft 365 back itself up?
No. Microsoft 365 has limited native retention and versioning, but under Microsoft’s shared responsibility model it isn’t a backup. We use AvePoint to protect mailboxes, OneDrive, SharePoint and Teams against deletion, ransomware and account compromise.
What does AvePoint back up?
Exchange Online mailboxes, OneDrive, SharePoint sites and Microsoft Teams, including the files and conversations within them.
How do you protect backups from ransomware?
Through immutable storage, separated credentials, off-site copies and tested restores. We design the backup environment so an attacker who reaches your live systems can’t reach the backups.
How often should restores be tested?
We recommend scheduled restore tests — typically quarterly for critical systems — rather than relying on backup-success notifications. Testing surfaces problems before they become incidents.
How does this relate to ASD Essentials?
The ASD Essentials series requires regular and proven backups: isolated from production, tested against recovery objectives, and — for cloud services — covering settings and tenant configuration with customer-controlled backup where provider arrangements fall short.
Do you provide documented recovery plans?
Yes. We document recovery sequence, contacts, decision points and basic runbooks so the response doesn’t depend on a single person remembering the steps.