01
Backups exist but have never been restored
The most common failure mode: a green dashboard for years, and the first restore attempt is during a real incident. Untested backups are not backups; they are hopes.
Service · Backup & Disaster Recovery
Backups that actually work.
We test the restore. We rehearse the runbook. We commit RTO and RPO in writing. When the primary tenant goes down at 2 a.m. (it almost never goes down at 10 a.m.), recovery follows a timeline you signed off on, not one we invent under pressure.
By Stefan Efros, CEO & Founder, EFROSReviewed by Daniel Agrici, Chief Security Officer, EFROS
Reviewed by CSO ·
Why backups fail when it matters.
02
Ransomware deletes backups too
Modern ransomware actors target backup infrastructure first. If your backup target is reachable from the production tenant with the same credentials, it's already compromised.
03
Microsoft 365 has no built-in long-term retention
Default retention in Microsoft 365 is short and recovery-bin-style. Mailbox loss after the deletion window — gone. SharePoint, OneDrive, and Teams chats all need third-party protection.
04
RTO and RPO are aspirational, not contractual
Most managed-IT contracts include backups but never define how fast recovery has to happen, or how much data loss is acceptable. When something goes down, neither side has a written commitment.
05
DR runbooks are missing or out of date
Most companies cannot describe — in writing — exactly what happens in the first hour after a disaster. The team that knew the plan left two years ago.
What's included.
- Microsoft 365 backup (mailboxes, SharePoint, OneDrive, Teams)
- Server / VM backup (Hyper-V, VMware, physical Windows / Linux)
- Cloud workload backup (Azure VMs, AWS EC2, Microsoft Fabric)
- Endpoint-data backup for laptops
- Immutable + air-gapped backup tier (ransomware-resilient)
- Documented Recovery Time Objective (RTO) per workload
- Documented Recovery Point Objective (RPO) per workload
- Quarterly test restores with documented results
- Annual disaster recovery exercise (tabletop or live)
- Encrypted off-site replication (AES-256 at rest, TLS in transit)
- Recovery runbook documentation kept current
- Reporting against SLA targets, included in monthly executive review
Frequently asked.
Do you back up our existing infrastructure or replace it?
We back up what you have. Veeam, Rubrik, Datto, Acronis, Microsoft 365 Backup — we operate the platforms that fit your environment. If your current setup is working and just needs better operations, we keep it.
How often do you test restores?
Quarterly at minimum. Critical workloads (Microsoft 365 mailboxes, primary file shares, ERP) test every month. Test results — including any failure — are documented in your monthly executive review.
What is your typical RTO / RPO?
Depends on workload class. Critical services typically target RTO under 4 hours and RPO under 1 hour. Standard services target RTO 24 hours, RPO 4 hours. Bulk archive can be 72 hours / 24 hours. The exact targets are negotiated and contractually defined per workload during onboarding.
Is the backup tier ransomware-resilient?
Yes. Backups land in an immutable + air-gapped tier that uses separate credentials, separate network paths, and write-once retention. Even if the primary tenant is compromised, the backup target cannot be deleted within its retention window.
Do you handle disaster recovery, not just backup?
Yes. Backup is the data part. DR is the runbook part — who pages who, in what order, with which authority. Both are operated together. Annual DR exercise included with the Fortress SOC tier.